Effective May 15, 2023, Container Registry is deprecated. If you currently use Container Registry, you can transition to Artifact Registry.
Artifact Registry is the recommended service for container image storage and management on Google Cloud. Artifact Registry provides the same container management features as Container Registry and includes additional features and benefits. As a fully-managed service with support for both container images and non-container artifacts, Artifact Registry extends the capabilities of Container Registry.
Summary of new features
Artifact Registry extends the capabilities of Container Registry with the following features:
- Repository-level access control.
- Hosting artifacts in regions to reduce latency and egress costs, and to comply with data residency requirements.
- Stream images to Google Kubernetes Engine and Dataproc Serverless to reduce workload startup times.
- Deploying to Cloud Run from source.
- Audit logging for repository activity.
- Enforcement of organization policy, including encryption with customer-managed encryption keys (CMEK) and location constraints.
- Scanning for Go and Java vulnerabilities in addition to OS vulnerabilities in containers.
- Virtual repositories that aggregate multiple repositories behind a single host (Preview).
- Remote repositories that cache artifacts from upstream sources such as Docker Hub or Maven Central (Preview).
See the feature comparison for more details about these features.
Backwards compatibility and co-existence
You can use both Artifact Registry and Container Registry in the same
project. When you view a list of repositories with
Google Cloud console, Artifact Registry also lists Container Registry
repositories in the same project.
Choose a transition option
There are two types of repositories you can use to transition to Artifact Registry:
- Repositories with gcr.io domain support
Special repositories that are mapped to Container Registry
gcr.iohostnames. Artifact Registry can redirect
gcr.iorequests for your Container Registry hosts to corresponding Artifact Registry repositories in the same Google Cloud project.
Use this option if:
- You want to minimize the amount of setup and configuration required to transition your existing images and automation to Artifact Registry.
- You do not need to set up Artifact Registry repositories in a different Google Cloud project or region.
- Standard repositories
Regular Artifact Registry repositories that support all features and are fully independent of any existing Container Registry hosts.
Use standard repositories instead if:
- You have compliance requirements to store data in a specific region.
gcr.iodomain support are only available in the same multi-regions as Container Registry hosts:
- You want to set up your Artifact Registry repositories in a project that is different from the project where you are using Container Registry.
You want to redesign how and where you store images. For example:
- Create repositories in the same regions as your other Google Cloud regional resources, including runtimes such as Cloud Run and Google Kubernetes Engine.
- Set up repositories in regions that are closer to your teams. For example,
you can create repositories in Australian regions instead of the
asiamulti-region, or in South American regions instead of the
- Create multiple Docker repositories in the same project and location with
different Identity and Access Management policies. For example, you can set up a development
repository and production repository in the
us-east1region with different levels of access for developers.
Create virtual repositories that act as a single endpoint for downloads from multiple upstream standard repositories.
- You have compliance requirements to store data in a specific region. repositories with
Both types of repositories can co-exist. For example, you can create gcr.io repositories in Artifact Registry to transition your existing Container Registry setup and create standard repositories for new work.
The following table summarizes differences between Container Registry and Artifact Registry.
|Feature||Container Registry||Artifact Registry|
|Supported formats||Container images only||Multiple artifact formats, including container images, language packages, and OS packages.|
Artifact Registry can also store images for the
|Repository modes||Not applicable||
|Registry creation||You create a registry host by pushing the first image to it.
Container Registry stores images in Cloud Storage buckets in your Google Cloud project and actions such as granting registry-specific permissions must be applied directly to a bucket.
|Creating a repository is a separate operation from pushing and pulling
to clearly separate repository administration from repository usage.
In Artifact Registry, there are no Cloud Storage buckets to manage in your Google Cloud projects. You perform image management actions directly on a repository.
|Registry location||Only four multi-regional registry hosts are available in a Google Cloud project.||Create multiple, separately-controlled repositories in region or multi-region.|
|Authentication||Provides several authentication methods for pushing and pulling images with a third-party client.||Artifact Registry supports the same authentication methods as Container Registry. See Setting up authentication for Docker for details.|
|Customer-managed encryption keys (CMEK)||Use CMEK to encrypt the storage buckets that contain your images.||Use CMEK to encrypt individual repositories.|
|Using Google Cloud console||View and manage Container Registry images from the Container Registry section of Google Cloud console.||View a list of your Artifact Registry and Container Registry
repositories in the Artifact Registry
section of Google Cloud console. Manage your Artifact Registry
repositories and images from this page.
If you click a Container Registry repository, you are directed to the list of images in the Container Registry section of the Google Cloud console.
|Using gcloud and API commands||Uses gcloud container images commands. Commands support shortened digests. If you don't specify the
full digest string, Container Registry attempts to locate the correct image
based on the partial string.
There is no REST or RPC API for Container Registry.
|Uses gcloud artifacts docker commands. Commands don't support shortened digests.
For a comparison of Container Registry and Artifact Registry gcloud commands, see the gcloud command comparison.
Artifact Registry provides a REST and RPC API for managing repositories and artifacts.
|Pub/Sub notifications||Publishes changes to the
||Publishes changes to the
To learn more, see Configuring Pub/Sub notifications.
|Audit logging||Container Registry does not provide audit logs for registry activity.||Use Cloud Logging to track changes to your repositories.|
|Cached Docker Hub images||
||Set up a remote repository to cache Docker Hub images that your consumers request. You can also scan images in a remote repository for vulnerabilities with Artifact Analysis.|
|VPC Service Controls||You can add Container Registry to a service perimeter.||You can add Artifact Registry to a service perimeter.|
|Metadata storage and analysis with Artifact Analysis||Scans for OS and language package vulnerabiities with on-demand scanning
in images with a supported OS. Automatic scanning only returns OS
Learn more about types of
||Scans for OS and lanaguage package vulnerabiities with both on-demand and
Learn more about types of
|Image streaming||Unavailable||Stream images in Artifact Registry to GKE or Dataproc Serverless for faster autoscaling, faster pod startup, and reduced latency when pulling large images.|
|Cloud Run source deployment||Unavailable||Source deployment lets you use a single gcloud CLI command to build a container image from your source code, store the image in Artifact Registry, and deploy it to Cloud Run.|
|Pricing||Container Registry pricing is based on Cloud Storage usage, including storage and network egress. Since registry hosts are only available in multi-regions, egress costs include deploying images to Google Cloud||Artifact Registry has its own pricing, based on storage and network egress.|
|Quota||Container Registry has fixed request limits. Cloud Storage quotas also apply. For details, see the quota and limits documentation.||Artifact Registry has per-project and per-user quotas. Per-user quota is unlimited by default, but you can configure a per-user cap so that a single user does not consume too much of the project-level quota.|
gcloud command comparison
The following table summarizes Container Registry commands and the equivalent Artifact Registry commands in the gcloud CLI. Click a link in the table to view reference page for the command.
The table does not include all available Artifact Registry commands that have no equivalent in Container Registry. See the gcloud artifacts documentation for the full Artifact Registry command reference.
|Operation||Container Registry||Artifact Registry|
|Create a repository||Not applicable.||gcloud artifacts repositories create|
|Delete a repository||Not applicable.||gcloud artifacts repositories delete|
|List images||gcloud container images list||gcloud artifacts docker images list|
|List tags||gcloud container images list-tags||gcloud artifacts docker tags list|
|Add a tag||gcloud container images add-tag||gcloud artifacts docker tags add|
|Delete a tag||gcloud container images untag||gcloud artifacts docker tags delete|
|Describe images||gcloud container images describe||gcloud artifacts docker images list --include-tags|