Container Virtual Registry

3/12/2026

Introduces and details GitLab's Container Virtual Registry, a new capability that functions as a pull-through cache for upstream container registries. The post explains the problem of managing multiple registries, credential sprawl, and slow build times. It describes how the virtual registry works by caching images from configured upstreams (Docker Hub, dhi.io, MCR, Quay.io) and serving them from GitLab's infrastructure. It provides setup instructions using a Python client and a `.gitlab-ci.yml` example, and discusses practical considerations like cache validity and upstream priority. It also highlights the benefits for Docker Hardened Images and provides performance metrics.

2/25/2026

Introduced the Container Virtual Registry beta, a feature that acts as a pull-through cache for upstream container registries. It simplifies managing multiple registries by providing a single GitLab endpoint, consolidating authentication, and improving build performance through caching. The beta supports API-first configuration for upstream registries using long-lived token authentication and includes pull-through caching. UI management is in progress, and future iterations will consider cloud provider registries requiring IAM authentication.

10/8/2025

This post details the expansion of GitLab's artifact management capabilities beyond container registries to include virtual registries for Maven, npm, and Docker/OCI formats. It introduces enterprise-grade features such as proxying and caching upstream dependencies for improved build reliability and supply chain control. The post also outlines planned enhancements for lifecycle management, security integration (including a Dependency Firewall), and advanced analytics, alongside performance and scale characteristics of current deployments.

5/22/2025

This post introduces the concept of a Maven Virtual Registry, analogous to the existing Container Virtual Registry. It details how to secure and optimize Maven repositories within GitLab using Personal Access Tokens, Deploy Tokens, CI/CD variables, GPG signing, and built-in security features like Dependency Scanning. It also covers performance optimizations such as dependency management, multi-module projects, parallel builds, and build caching. The post announces a beta program for the Maven Virtual Registry, highlighting its key features: repository aggregation, smart proxy and caching, and centralized access control.

3/24/2025

This post details how GitLab is responding to upcoming Docker Hub rate limits by enhancing the Dependency Proxy feature to support Docker Hub authentication. This allows the Dependency Proxy to pull images as an authenticated user, significantly increasing rate limits and mitigating pipeline failures. It also provides guidance on configuring pipeline authentication for direct Docker Hub pulls, using the GitLab Container Registry, and leveraging the enhanced Dependency Proxy with UI-based configuration in upcoming releases.

2/19/2025

This post details how to structure the GitLab Package Registry for enterprise scale, focusing on Maven and npm packages. It explains the GitLab model of integrating package management into project/group structures, contrasting it with centralized repositories. Key recommendations include using root group registries as a best practice for a single access point, consistent naming, simplified configuration, and secure access management via deploy tokens and CI_JOB_TOKEN. It provides publishing and consuming configuration examples for Maven and npm, and outlines benefits like simplified configuration, clear ownership, and natural organization.

2/13/2025

Introduces an automated GitLab CI pipeline to migrate container images from Amazon ECR to GitLab's Container Registry. The pipeline uses Docker-in-Docker, requires specific IAM permissions for ECR read-only access, and configures GitLab CI variables for AWS credentials and region. It automates the discovery of repositories and tags in ECR, then performs `docker pull`, `docker tag`, and `docker push` operations to transfer images to the GitLab registry. Best practices for off-peak execution, log monitoring, and ECR decommissioning are provided.

9/9/2024

This post details the integration of Chainguard's hardened container images with GitLab, enabling users to leverage minimal, secure base images directly within GitLab CI jobs or Dockerfiles. It also covers container image signing using Sigstore/Cosign for authenticity, trust, and integrity, and outlines GitLab's comprehensive suite of vulnerability scanning tools (SAST, DAST, IaC, Container Scanning, Dependency Scanning, Secret Detection, API Fuzzing, Coverage-guided Fuzzing) to maintain security posture as dependencies are added to hardened images.

9/4/2024

This post introduces the integration of Cosign into GitLab CI/CD pipelines for container image provenance. It details a `.gitlab-ci.yml` configuration that automates building, signing, and annotating Docker images using Cosign and the GitLab container registry. Key technical contributions include setting up Docker-in-Docker, using OIDC tokens for keyless signing, installing Cosign, logging into the GitLab registry, building and pushing images, retrieving image digests, signing images with specific annotations (e.g., user name, pipeline ID, job URL, commit SHA), and verifying signatures with annotations and certificate identity checks.

7/23/2024

This post announces the general availability of the next-generation GitLab container registry for self-managed deployments, moving it off by default starting with GitLab 17.3. It details the goals and non-goals for GA, including a stable registry API, metadata database, and zero-downtime garbage collection, while excluding automatic database provisioning and object storage data import. For existing instances, it outlines the opt-in database enablement process, continued security updates for the legacy registry, and a target deprecation date for the legacy registry in GitLab 19.0. It also highlights future roadmap items like protected repositories and immutable tags.

1/16/2024

The post outlines the roadmap for GitLab Package and Container Registry in 2024. For the Package Registry, it details the upcoming dependency proxy for Maven, npm, PyPI, and NuGet, which will act as a virtual registry to cache external packages, improving pipeline speed and reliability while reducing data transfer costs. For the Container Registry, the focus is on achieving General Availability for self-managed customers, improving UI/UX, adding granular access protection and immutable tags, and integrating with Google Cloud Platform's Artifact Registry.

12/4/2023

This post details the migration to a next-generation container registry, addressing issues with the legacy Distribution project fork. Key improvements include solving the online garbage collection problem, leading to terabytes of data deletion daily on GitLab.com, improved performance and reliability, and significant cost savings. The post also encourages self-managed customers to migrate to unlock these benefits and provides a roadmap for future features such as improved sorting/filtering, UI enhancements for manifest/multi-arch images, attestation/signing, Helm chart storage, protected repositories, and immutable tags.

3/16/2023

This post details how GitLab CI/CD and its dependency proxy can be used to mitigate the impact of Docker Hub's open-source image removal. It provides methods for inventorying container images used in CI/CD pipelines and Kubernetes manifests, including using the CI lint API and advanced search. It also discusses solutions like the dependency proxy and custom container image building to ensure supply chain reliability.

4/12/2022

This post details the second phase of the migration of the GitLab.com Container Registry to a new version. This phase focuses on migrating existing image repositories created before January 22, 2022, to the new registry which utilizes a PostgreSQL backend for metadata and includes an automatic online garbage collector. The migration is planned to be phased by tier (GitLab.org, Free, Premium, Ultimate) and includes a brief read-only period for each repository during its final migration step. The post also highlights expected benefits such as storage visibility, performance improvements, and UI enhancements.

1/13/2022

This post details the integration of Google Cloud CDN with the GitLab.com Container Registry. The change redirects download requests for blobs from Google Cloud Storage to Google Cloud CDN (`cdn.registry.gitlab-static.net`) to optimize costs and improve performance, especially for GitLab CI users. Requests originating from within GCP will continue to use Cloud Storage. The rollout will be gradual, starting in late January 2022, and users who allow-list `storage.googleapis.com` will need to add `cdn.registry.gitlab-static.net`.

10/25/2021

This post announces the upcoming rollout of a new version of the Container Registry on GitLab.com. The key technical change is the introduction of a new metadata database in Postgres to store image/tag metadata, moving away from storing it in the storage backend. This enables features like storage usage visibility, improved API and UI performance for list operations, and enhancements to the UI including build and commit metadata for tags built via CI and search by tag name. The rollout will be phased, starting with newly-created repositories.

10/18/2021

This post introduces the integration of Helm charts into the GitLab Package Registry, building upon the existing Container Registry functionality. It details the process of creating a Helm chart, packaging it, and pushing it to the GitLab Helm Package Registry using the `helm-push` plugin and CI/CD automation. The post also explains how to install Helm charts from the registry into Kubernetes. This extends the DevOps lifecycle by providing a centralized distribution mechanism for both container images and their deployment configurations.

7/26/2021

Introduced a dedicated Helm registry as a new package type within GitLab, distinct from the Container Registry and Git repositories. This feature allows for centralized management, security scanning, and controlled distribution of Helm charts for Kubernetes applications.

5/23/2016

This post announces the release of GitLab Container Registry as part of GitLab 8.8. It describes the registry as a secure and private Docker image registry fully integrated with GitLab, requiring no additional installation. Key features highlighted include user authentication via GitLab, project-specific repositories, easy upload/download from GitLab CI, and simplified workflows for building, storing, and deploying Docker images. It also provides basic Docker concepts, examples of workflow simplification, and instructions on how to enable and use the registry with GitLab CI, including sample `.gitlab-ci.yml` configurations.