GCP Artifact Registry

Managed registry for Docker, npm, Maven, Python — IAM auth, vulnerability scanning, regional repos.

GCPBeginner

Why

Artifact Registry replaces Container Registry — supports Docker + npm + Maven + Python in one. IAM auth, vulnerability scanning, regional repos for latency. $0.10/GB/mo.

When

Use for any GCP container/package deployment. Avoid for public packages (use npmjs/PyPI) or multi-cloud (use GHCR).

How

1. Create repo — gcloud artifacts repositories create my-repo --repository-format docker 2. Auth — gcloud auth configure-docker us-central1-docker.pkg.dev 3. Push — docker push us-central1-docker.pkg.dev/proj/my-repo/app:v1 4. Scan — on push, Container Analysis API for CVEs 5. Cleanup — delete old images, policies for auto-clean 6. Multi-format — Docker, npm, Maven, Python in same repo family 7. Regional — us-central1, europe-west1, latency for pulls 8. KMS — CMEK for encryption

Example

# Create Docker repo gcloud artifacts repositories create my-repo \ --repository-format docker \ --location us-central1 \ --description "App images" # Auth + push gcloud auth configure-docker us-central1-docker.pkg.dev docker tag app:v1 us-central1-docker.pkg.dev/$PROJECT_ID/my-repo/app:v1 docker push us-central1-docker.pkg.dev/$PROJECT_ID/my-repo/app:v1 # Scan for vulnerabilities gcloud artifacts docker images scan \ us-central1-docker.pkg.dev/$PROJECT_ID/my-repo/app:v1

Common Problems

⚠Old images accumulate — set cleanup policy, auto-delete old
⚠Scan findings ignored — fail CI on CRITICAL, not just report
⚠Wrong region — pull from deployment region for speed

Best Practices

✓Use regional repo — co-locate with deployment, faster pulls
✓Enable scanning — auto on push, fail CI on CRITICAL CVEs
✓Set cleanup policy — auto-delete old/untagged, controls cost

FAQ

What is GCP Artifact Registry and what problem does it solve?

Managed registry for Docker, npm, Maven, Python — IAM auth, vulnerability scanning, regional repos. It lets developers deploy, store, and scale without self-managing infrastructure — a core reference for cloud service selection.

How do I get started with GCP Artifact Registry in 5 minutes?

Two steps to run it: (1) Create repo — gcloud artifacts repositories create my-repo --repository-format docker; (2) Auth — gcloud auth configure-docker us-central1-docker.pkg.dev. Validate on the free tier first, then wire into production.

What is the #1 pitfall with GCP Artifact Registry?

The most frequent issue is: Old images accumulate — set cleanup policy, auto-delete old. Run a pre-launch checklist item by item, and add policy/config scanning in CI.

What are the best practices for GCP Artifact Registry?

Best practices for GCP Artifact Registry include: Use regional repo — co-locate with deployment, faster pulls; Enable scanning — auto on push, fail CI on CRITICAL CVEs; Set cleanup policy — auto-delete old/untagged, controls cost. The first one — "Use regional repo — co-locate with deployment, faster pulls" — should be a team default baked into your IaC templates.

How do I control cost and avoid bill surprises with GCP Artifact Registry?

Three ways to prevent overspend: (1) tag every resource with env/team and enable billing alarms; (2) set budget thresholds to trigger Slack/email alerts; (3) review idle resources in Cost Explorer regularly and clean them up. Most GCP Artifact Registry options offer a free tier — validate within free quota before scaling.