Artifact Registry

This chapter follows IAM in Google Cloud. Artifact Registry is Google Cloud’s managed registry for OCI container images, language packages, and related formats. Google Container Registry is retired; new work uses Artifact Registry only.

The series deployer service account needs roles/artifactregistry.writer before you can push.

Repositories and formats

Create a repository in a location (region) with a format:

Docker image URLs follow:

1
LOCATION-docker.pkg.dev/PROJECT_ID/REPOSITORY/IMAGE:TAG

Example: europe-west1-docker.pkg.dev/my-project/file-api/app:v1.

Create a Docker repository

1
gcloud artifacts repositories create file-api \
2
  --repository-format=docker \
3
  --location=europe-west1 \
4
  --description="Series file API images"

List repositories:

1
gcloud artifacts repositories list --location=europe-west1

Grant readers if other projects or people must pull without write access:

1
gcloud artifacts repositories add-iam-policy-binding file-api \
2
  --location=europe-west1 \
3
  --member="serviceAccount:file-api-runtime@YOUR_PROJECT_ID.iam.gserviceaccount.com" \
4
  --role="roles/artifactregistry.reader"

Cloud Run’s service agent pulls images at deploy time; project defaults usually suffice, but explicit reader on the repository documents intent.

Authenticate Docker to Artifact Registry

Configure the Docker credential helper:

1
gcloud auth configure-docker europe-west1-docker.pkg.dev

On CI, run as the deployer service account (ADC or impersonation) before docker push.

Build and tag locally from the series app directory:

1
export REGION=europe-west1
2
export PROJECT_ID=YOUR_PROJECT_ID
3
export IMAGE="${REGION}-docker.pkg.dev/${PROJECT_ID}/file-api/app:v1"
4

5
docker build -t "${IMAGE}" .
6
docker push "${IMAGE}"

Verify:

1
gcloud artifacts docker images list \
2
  "${REGION}-docker.pkg.dev/${PROJECT_ID}/file-api" \
3
  --include-tags

Tags, immutability, and cleanup

Use immutable tags on production repositories if your org requires it—overwriting :latest cannot happen accidentally.

Cleanup policies delete old untagged manifests or aged images to control cost:

1
gcloud artifacts repositories set-cleanup-policies file-api \
2
  --location=europe-west1 \
3
  --policy=keep-recent.json

A minimal policy file keeps the last few versions; adjust for compliance needs.

Vulnerability scanning

Artifact Registry can scan images for known CVEs (configuration depends on organization policy). View results in the Console or with:

1
gcloud artifacts docker images scan "${IMAGE}"

Treat critical findings like application defects: rebuild base images, pin patched tags, and redeploy Cloud Run.

IAM on repositories

Prefer repository-level roles/artifactregistry.reader and roles/artifactregistry.writer over project-wide storage roles. The deployer account is a writer; runtime and Cloud Run need read access to pull.

Next: Deploying containers with Cloud Run runs this image as a managed service.