Tempat Menyimpan dan Berbagi Docker Image

Container registry adalah tempat menyimpan Docker image. Setelah build di CI, image di-push ke registry. Saat deploy, server pull image dari registry. Sama konsepnya dengan Git + GitHub, tapi untuk image.

Registry Populer

• Docker Hub — registry default, paling umum. Gratis untuk public image. Repo privat terbatas di free tier
• GitHub Container Registry (GHCR) — ghcr.io. Gratis tidak terbatas untuk public, terintegrasi dengan GitHub Packages dan Actions
• AWS ECR — Elastic Container Registry. Terintegrasi dengan ECS/EKS, auth via IAM
• Google Artifact Registry — pengganti GCR, multi-format (Docker, npm, Maven), regional
• Azure Container Registry (ACR) — native di Azure
• Harbor — open source, self-hosted, fitur enterprise (vulnerability scan, signing)

Push & Pull Workflow

# Login ke registry (sekali per mesin)
docker login                          # Docker Hub
docker login ghcr.io -u USERNAME      # GitHub
aws ecr get-login-password --region ap-southeast-1 | \
  docker login --username AWS --password-stdin \
  123456789.dkr.ecr.ap-southeast-1.amazonaws.com

# Build & tag
docker build -t myapp:v1.0.0 .

# Tag untuk registry tertentu (format: REGISTRY/NAMESPACE/NAME:TAG)
docker tag myapp:v1.0.0 ghcr.io/ivqonsanada/myapp:v1.0.0
docker tag myapp:v1.0.0 ghcr.io/ivqonsanada/myapp:latest

# Push
docker push ghcr.io/ivqonsanada/myapp:v1.0.0
docker push ghcr.io/ivqonsanada/myapp:latest

# Pull di server production
docker pull ghcr.io/ivqonsanada/myapp:v1.0.0
docker run -d -p 80:3000 ghcr.io/ivqonsanada/myapp:v1.0.0

Image Tagging Strategy

Tag yang baik = deploy yang bisa di-reproduce dan di-rollback. Praktik umum:

1. Semantic Version (untuk Release Publik)

# Tag manual sesuai release
myapp:1.0.0       # major.minor.patch
myapp:1.0         # major.minor (floating)
myapp:1           # major (floating)
myapp:latest      # selalu terbaru

2. Git SHA (untuk Deploy Internal)

# Tiap commit dapat tag unik — bisa di-trace ke kode exact
myapp:7f3a9b2              # short sha
myapp:main-7f3a9b2         # branch + sha

# Di CI:
docker build -t myapp:${GITHUB_SHA::7} .

3. Hindari Pakai latest di Production

# BURUK — saat deploy, kamu tidak tahu persis versi apa yang jalan
docker pull myapp:latest
docker run myapp:latest

# BAIK — explicit, bisa di-rollback
docker pull myapp:v1.2.3
docker run myapp:v1.2.3

4. Pattern Produksi: Kombinasi Tag

Satu image, beberapa tag:

# Di CI, setelah build:
docker tag myapp myapp:v1.2.3             # semver (stable ref)
docker tag myapp myapp:1.2                # floating minor
docker tag myapp myapp:${GIT_SHA}         # immutable ref
docker tag myapp myapp:production          # env pointer
# Deploy pakai sha — bisa investigate commit persis

Private Registries

Untuk repo internal yang tidak boleh publik: gunakan private registry (Docker Hub private, GHCR private, ECR, self-hosted Harbor). Auth via:

• Username + password (basic)
• Access token (lebih aman, bisa di-scope)
• IAM role (AWS ECR, GCP Artifact Registry) — no long-lived credential

Vulnerability Scanning

Registry modern otomatis scan image untuk CVE (Common Vulnerabilities and Exposures) di dependency. Contoh:

• Docker Hub Scout / GHCR — built-in scanning
• AWS ECR Enhanced Scanning — pakai Amazon Inspector
• Trivy — open source scanner, bisa dipakai di CI sebelum push
• Snyk — SaaS dengan dashboard

# Scan lokal sebelum push
trivy image myapp:v1.0.0
# Output: CRITICAL, HIGH, MEDIUM, LOW CVE per dependency

Integrasi di CI — fail build jika ada CRITICAL CVE. Patch base image (node:20-alpine → node:20-alpine3.19) atau update dependency.

Image Signing (Singkat)

Memastikan image yang di-pull benar-benar dari publisher yang dipercaya, belum dimodifikasi di tengah jalan. Tools:

• Docker Content Trust (DCT) — berbasis Notary
• Cosign (Sigstore project) — modern, keyless signing pakai OIDC
• SLSA provenance — attest build provenance untuk supply chain security

# Contoh cosign sign
cosign sign ghcr.io/me/myapp:v1.0.0
cosign verify ghcr.io/me/myapp:v1.0.0

Relevan untuk supply chain security — mencegah attacker swap image di registry dan deploy malicious build ke production.