Tagging strategy

  • :latest — never use in production manifests. It is mutable and changes silently.
  • :1.4.2 — semantic version. Immutable. Use in production deployments.
  • :main-abc1234 — branch + commit SHA. Good for CI/CD pipelines and staging deployments.
  • :sha-abc1234def5 — full digest. Most reproducible. Used in secure supply chain pipelines.

Vulnerability scanning

Integrate Trivy or Grype into CI — fail the build on HIGH or CRITICAL CVEs. Scan images on push via registry hooks (ECR scanning, Docker Hub scanning). Rebuild base images on a schedule to pick up OS patches even when application code has not changed.

Retention policies

Untagged images accumulate quickly in active registries. Set lifecycle rules: delete untagged images older than 7 days; keep only the last 10 tagged versions per repository.

Registry options

  • AWS ECR — deep IAM integration, private, OCI-compliant.
  • GitHub Container Registry (ghcr.io) — integrated with GitHub Actions, free for public repos.
  • Harbor — open-source, self-hosted, with built-in scanning and replication.