TopolearnEvery Cloud Run, GKE and Cloud Build workflow pulls images from here.
Artifact Registry hosts container images and packages (npm, Maven, Python, Go, Apt, Yum). It replaces the retired Container Registry (gcr.io).
A repository has a format (docker, python, npm...) and a location. Image paths look like:
LOCATION-docker.pkg.dev/PROJECT_ID/REPOSITORY/IMAGE:TAG
Put repositories in the same region as the services that pull from them for speed and to avoid egress.
Authenticate Docker once with gcloud auth configure-docker LOCATION-docker.pkg.dev; this installs gcloud as a credential helper. Cloud Build, Cloud Run and GKE use their service accounts, which need roles/artifactregistry.reader (pull) or writer (push) on the repository or project.
Repository modes:
- Standard: your own artifacts.
- Remote: a caching proxy of Docker Hub, PyPI, npm and others, shielding you from upstream rate limits and outages.
- Virtual: one endpoint that searches several repositories in order.
Useful extras: cleanup policies to delete old untagged images automatically, immutable tags so v1.2.0 can never be overwritten, and vulnerability scanning of images. Deploy by digest (@sha256:...) or immutable tags in production so what runs is exactly what was tested.
Example
gcloud artifacts repositories create apps --repository-format=docker \
--location=europe-west1 --immutable-tags --description="Shop images"
gcloud auth configure-docker europe-west1-docker.pkg.dev
IMAGE=europe-west1-docker.pkg.dev/shop-dev-4821/apps/orders-api:1.4.0
docker build -t $IMAGE .
docker push $IMAGE
gcloud artifacts docker images list europe-west1-docker.pkg.dev/shop-dev-4821/apps --include-tagsRemember
- Image path: LOCATION-docker.pkg.dev/PROJECT/REPO/IMAGE:TAG
- configure-docker sets up auth for docker push and pull
- Use remote repos for upstream caching and cleanup policies for old images
Watch out for
- Pushing to gcr.io in new projects; use Artifact Registry paths.