Container Registry: Docker Images verwalten

Container Registries speichern und verteilen Docker Images. Lernen Sie die wichtigsten Registries und wie Sie sie nutzen.

Beliebte Registries

Docker Hub

# Login
docker login

# Image taggen
docker tag myapp:latest username/myapp:latest
docker tag myapp:latest username/myapp:1.0.0

# Push
docker push username/myapp:latest
docker push username/myapp:1.0.0

# Pull
docker pull username/myapp:latest

# Offizielle Images (kein Username)
docker pull nginx
docker pull postgres:15

GitHub Container Registry (GHCR)

# Personal Access Token erstellen:
# GitHub → Settings → Developer settings → Tokens
# Permissions: write:packages, read:packages

# Login
echo $GITHUB_TOKEN | docker login ghcr.io -u USERNAME --password-stdin

# Image taggen
docker tag myapp:latest ghcr.io/username/myapp:latest

# Push
docker push ghcr.io/username/myapp:latest

# In GitHub Actions
- name: Login to GHCR
  uses: docker/login-action@v3
  with:
    registry: ghcr.io
    username: ${{ github.actor }}
    password: ${{ secrets.GITHUB_TOKEN }}

- name: Build and Push
  uses: docker/build-push-action@v5
  with:
    push: true
    tags: ghcr.io/${{ github.repository }}:latest

AWS ECR

# ECR Repository erstellen
aws ecr create-repository --repository-name myapp

# Login (temporäre Credentials)
aws ecr get-login-password --region eu-central-1 | \
  docker login --username AWS --password-stdin \
  123456789.dkr.ecr.eu-central-1.amazonaws.com

# Tag und Push
docker tag myapp:latest 123456789.dkr.ecr.eu-central-1.amazonaws.com/myapp:latest
docker push 123456789.dkr.ecr.eu-central-1.amazonaws.com/myapp:latest

# Lifecycle Policy (alte Images löschen)
aws ecr put-lifecycle-policy \
  --repository-name myapp \
  --lifecycle-policy-text file://policy.json

GitLab Container Registry

# Login
docker login registry.gitlab.com

# oder mit Token
docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY

# Push
docker tag myapp registry.gitlab.com/username/project/myapp:latest
docker push registry.gitlab.com/username/project/myapp:latest

# In .gitlab-ci.yml
build:
  stage: build
  script:
    - docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
    - docker build -t $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA .
    - docker push $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA

Private Registry (Self-Hosted)

# Einfache Registry starten
docker run -d -p 5000:5000 --name registry registry:2

# Mit Persistenz
docker run -d -p 5000:5000 \
  -v /data/registry:/var/lib/registry \
  --name registry registry:2

# Push zu lokaler Registry
docker tag myapp localhost:5000/myapp:latest
docker push localhost:5000/myapp:latest

# Mit Authentifizierung (htpasswd)
docker run -d -p 5000:5000 \
  -v /auth:/auth \
  -e "REGISTRY_AUTH=htpasswd" \
  -e "REGISTRY_AUTH_HTPASSWD_REALM=Registry" \
  -e "REGISTRY_AUTH_HTPASSWD_PATH=/auth/htpasswd" \
  registry:2

# htpasswd erstellen
htpasswd -Bc /auth/htpasswd username

Image Tags Best Practices

# ❌ Nur latest
myapp:latest

# ✅ Versionierung
myapp:1.0.0           # Semver
myapp:1.0             # Minor
myapp:1               # Major
myapp:latest          # Auch, aber zusätzlich

# ✅ Mit Git SHA
myapp:abc1234
myapp:1.0.0-abc1234

# ✅ Mit Build-Nummer
myapp:build-123

# Typisches Tagging in CI
IMAGE_NAME=ghcr.io/org/myapp
VERSION=1.0.0
SHA=$(git rev-parse --short HEAD)

docker tag myapp $IMAGE_NAME:$VERSION
docker tag myapp $IMAGE_NAME:$SHA
docker tag myapp $IMAGE_NAME:latest

Multi-Arch Images

# Für ARM und x86 bauen
docker buildx create --use

docker buildx build \
  --platform linux/amd64,linux/arm64 \
  -t username/myapp:latest \
  --push .

# Manifest inspizieren
docker manifest inspect username/myapp:latest

Images aufräumen

# Lokal
docker image prune -a    # Alle ungenutzten
docker system prune -a   # Alles (Vorsicht!)

# Docker Hub: Manuell im UI oder API

# GHCR: Über GitHub UI oder API
gh api -X DELETE /user/packages/container/myapp/versions/123

# ECR: Lifecycle Policies
{
  "rules": [{
    "rulePriority": 1,
    "selection": {
      "tagStatus": "untagged",
      "countType": "sinceImagePushed",
      "countNumber": 7,
      "countUnit": "days"
    },
    "action": { "type": "expire" }
  }]
}

Weitere Informationen

• 🐳 Docker Grundlagen
• 📦 Multi-Stage Builds
• 🔄 CI/CD Pipelines