TechPrufer
Get started
GitLab
GitLab logoGitLab · Feature trail

Container Virtual Registry

22 posts · May 2016 – Oct 2026

What this trail covers

GitLab Container Registry is evolving to support a Container Virtual Registry, which acts as a single endpoint to pull from multiple upstream container sources with built-in caching. This feature aims to reduce operational overhead, improve pipeline reliability, and centralize image management for organizations using multiple registries. It supports upstream registries with long-lived token authentication and pull-through caching, with future plans to include cloud provider registries requiring

All GitLab trails
  1. Every artifact your teams ship, assembled right the first timeIntroduces GitLab Artifact Central, an organization-level registry that replaces project-level ones. It offers Hosted, Remote (proxy), and Virtual repository types. Key features include centralized policy management (retention, storage, access), organization-level roles separate from project roles, and automatic build provenance (pipeline, branch, commit, job token) attached to artifacts. It supports Maven, npm, Docker, and OCI formats. It integrates with Dependency Firewall and offers a gradual migration path by adding existing repos as remotes.
  2. GitLab Container Virtual Registry with Docker Hardened ImagesThis post details the setup and benefits of GitLab's Container Virtual Registry, specifically highlighting its use with Docker Hardened Images. It explains how the virtual registry acts as a pull-through cache for multiple upstream registries (Docker Hub, dhi.io, MCR, Quay.io), consolidating authentication and reducing CI/CD build times by caching images. The post provides code examples for creating virtual registries and upstreams using the `virtual_registry_client` and demonstrates updating CI/CD configurations to use the virtual registry. It also discusses image path formats for different registries, cache validity, upstream priority, and limits. The UI configuration for virtual registries and upstreams is also mentioned, along with future development plans for allow/deny lists.
  3. GitLab metrics and registry features help reduce CI/CD bottlenecksThis post introduces two new beta features: CI/CD Job Performance Metrics and Container Virtual Registry. CI/CD Job Performance Metrics adds a panel to the CI/CD analytics page showing typical and worst-case job duration, failure rate, job name, and stage for the last 30 days. Container Virtual Registry allows users to configure a single GitLab endpoint that pulls from multiple upstream registries (Docker Hub, Harbor, Quay, etc.) with pull-through caching, supporting long-lived token authentication. Future iterations will include cloud provider registries with IAM authentication.
  4. Optimize GitLab object storage for scale and performanceThis post details the configuration of object storage for GitLab components, including specific guidance for the container registry. It introduces the s3_v2 driver as the successor to s3_v1, emphasizes using identity-based authentication (IAM roles for AWS, application default credentials for GCP, workload identities for Azure) over access keys, and outlines how to enable server-side encryption. It also details disabling proxy downloads for performance and using separate buckets for organization. Key configuration differences between consolidated object storage and the container registry are summarized.
  5. Streamline enterprise artifact management with GitLabThis post details GitLab's strategic decision to focus on depth over breadth in artifact management, prioritizing enterprise-grade capabilities for core formats (Maven, npm, Docker/OCI, PyPI, NuGet, Generic, Terraform modules). It highlights current features like virtual registries (production-ready for Maven, coming for npm/Docker in Q1 2026), lifecycle management, security integration, and deep CI/CD integration. The roadmap outlines future enhancements for virtual registries, organization-level policies, an analytics dashboard, and a dependency firewall. The post also provides a decision framework for choosing GitLab and migration considerations.
  7. Tutorial: Secure and optimize your Maven Repository in GitLabThis post introduces the Maven Virtual Registry beta program, extending the concept of virtual registries to Maven packages. It details how to secure Maven repositories in GitLab using Personal Access Tokens, Deploy Tokens, and token rotation. It also covers leveraging built-in security features like Dependency Scanning, Container Scanning, and License Compliance, and securing CI/CD pipelines with masked variables and protected branches. Package signing with GPG and controlling package access are also discussed. For performance optimization, it highlights dependency management, multi-module projects, parallel builds, CI/CD caching, and build caching with the Gradle Enterprise Maven Extension. The Maven Virtual Registry itself is described as a feature that aggregates multiple Maven repositories, provides smart proxying and caching, and centralized access control, with configuration examples for `settings.xml` and `pom.xml`.
  8. Prepare now: Docker Hub rate limits will impact GitLab CI/CDThis post details how GitLab is responding to upcoming Docker Hub rate limits by enhancing the Dependency Proxy with Docker Hub authentication (available via GraphQL API in 17.10 and UI in 17.11/GitLab.com) and recommending the use of the GitLab Container Registry or Dependency Proxy for caching images. It also provides instructions for configuring direct Docker Hub authentication in CI/CD pipelines. The core technical delta is the enablement of authentication for the Dependency Proxy and the strategic guidance on mitigating external registry rate limits.
  9. Structuring the GitLab Package Registry for enterprise scaleThis post details how to structure the GitLab Package Registry for enterprise scale, focusing on Maven and npm packages. It introduces the concept of root group registries as a best practice for unified access and project-based publishing for clear ownership. The post outlines publishing and consuming configurations, authentication methods for CI/CD pipelines (using CI_JOB_TOKEN) and development (using group deploy tokens), and highlights the benefits of this model for simplified configuration, clear ownership, and natural organization. It provides real-world examples of enterprise structure and configuration for Maven and npm.
  10. Automating container image migration from Amazon ECR to GitLabThis post details a CI/CD pipeline for automating the migration of container images from Amazon ECR to GitLab's Container Registry. It includes setting up read-only AWS IAM permissions, configuring GitLab CI/CD variables (AWS_ACCOUNT_ID, AWS_DEFAULT_REGION, AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, BULK_MIGRATE), and a Docker-in-Docker pipeline script that discovers repositories, enumerates tags, and performs `docker pull`, `docker tag`, and `docker push` operations. Best practices for large migrations are also provided.
  11. Secure open source container infrastructure with GitLab and ChainguardThis post details the integration of Chainguard's minimal, hardened container images with GitLab. It demonstrates how to use these images directly within GitLab CI/CD jobs by setting the `image` directive and how to use them as base images in Dockerfiles, subsequently building and pushing these images to the GitLab Container Registry. The post also highlights container image signing using Sigstore/Cosign and the integration of GitLab's various security scanning tools (SAST, DAST, IaC Scanning, Container Scanning, Dependency Scanning, Secret Detection, API Fuzzing, Coverage-guided Fuzzing) to manage vulnerabilities within these containerized environments.
  12. Container image provenance with Cosign in GitLab CI/CDThis post introduces and demonstrates the integration of Cosign with GitLab CI/CD for container image provenance. It provides a detailed `.gitlab-ci.yml` example that automates building Docker images, signing them with Cosign using keyless signing via OIDC tokens, and annotating them with build metadata (user, pipeline, job, commit details). It also includes a verification step to ensure the integrity of the signature and annotations. The post explains the benefits of image signing and annotation for software supply chain security and DevSecOps.
  13. Next-generation GitLab container registry goes GAThe next-generation GitLab container registry is now generally available (off by default) for self-managed deployments starting with GitLab 17.3. This release includes stable and reliable registry API, metadata database, and zero-downtime garbage collection. It also introduces opt-in database schema migrations for Charts installs during upgrades. Non-goals for GA include automatic provisioning of the registry database, automatic schema migrations for omnibus installs, automatic import of object storage data, and Geo support. The legacy registry will continue to receive security updates but will stop being supported after GitLab 19.0. Future roadmap items include protected repositories, immutable tags, improved Helm chart management, and enhanced support for signing and attestations.
  14. GitLab Package roadmap for 2024The post announces plans for 2024 to bring the container registry to GA for self-managed customers, improve its UI/UX, add granular access protection and immutable container image tags, and integrate with Google Cloud's Artifact Registry. It also mentions the ongoing evolution of the next-generation container registry for GitLab.com with performance and reliability improvements.
  15. GitLab's next-generation container registry is now availableThis post details the migration to the next-generation container registry, highlighting the resolution of issues with the legacy Distribution project fork. Key improvements include solving the online garbage collection problem, which drastically reduces storage costs and downtime for GitLab.com. The post encourages self-managed customers to migrate to unlock these benefits and provide feedback. Future features planned for 2024 include GA for self-managed, improved sorting/filtering, enhanced UI for manifest/multi-arch images, attestation/signing, Helm chart storage, protected repositories, and immutable tags.
  16. GitLab helps mitigate Docker Hub's open source image removalThis post details how GitLab CI/CD and its dependency proxy can be used to mitigate the impact of Docker Hub's open-source image removal. It provides methods for inventorying container images used in CI/CD pipelines and Kubernetes manifests, including using the CI lint API and advanced search. It also discusses solutions like the dependency proxy and custom container image building to ensure supply chain reliability.
  17. Introducing the next generation of the GitLab.com Container RegistryThis post details the second phase of the migration of GitLab.com's Container Registry to a new, metadata database-backed architecture. This phase focuses on migrating existing repositories created before January 2022. The new architecture includes an automatic online garbage collector for untagged images and enables features such as storage visibility, performance improvements for API/UI list operations, and UI redesigns. The migration plan is phased by tier (GitLab internal, Free, Premium, Ultimate) and involves a brief read-only period for each repository during migration. Untagged images will be removed during garbage collection. Users are advised to tag any untagged images they wish to preserve and can optionally activate cleanup policies.
  18. Detecting container host anomalies with GitLab and FalcoThis post introduces the integration of Falco for container host security within GitLab. It details how to deploy Falco using GitLab-Managed Apps and the Kubernetes Agent, configure custom rules for detecting anomalies like file creation, and set up alerts for rule violations. The post also outlines the roadmap for future enhancements to Container Host Security, including Falco statistics, SIEM export, and UI-based policy management.
  19. GitLab.com Container Registry to use Google Cloud CDNThis post details the upcoming change to use Google Cloud CDN for the GitLab.com Container Registry, redirecting blob download and existence check requests from Google Cloud Storage to `cdn.registry.gitlab-static.net`. It outlines the technical mechanism of redirection, the gradual rollout plan, and the impact on users, specifically noting the need to update allow lists for `storage.googleapis.com` to include the new CDN endpoint.
  20. Announcing an exciting update to the GitLab.com Container RegistryThis post announces a major update to the GitLab.com Container Registry, introducing a new metadata database in Postgres to store metadata instead of the storage backend. This change enables features like storage usage visibility, performance improvements for API and UI list operations, and a redesign of the UI including build and commit metadata for tags built via CI, and search by tag name. The rollout will be phased, starting with newly-created repositories.
  21. Get started with GitLab's Helm Package RegistryThis post introduces the integration of Helm charts into the GitLab Package Registry, enabling users to store and distribute Helm charts alongside container images. It details the process of creating a Helm chart, packaging it, and pushing it to the GitLab Helm Package Registry using the `helm-push` plugin. It also provides examples of CI/CD jobs for automating the upload and installation of Helm charts.
  22. Introducing the GitLab Helm Package RegistryThis post introduces the new Helm Registry feature in GitLab 14.1. It explains what Helm is, why a dedicated Helm registry is beneficial over storing charts in Git or using the Container Registry (especially for regulated environments), and highlights the security, efficiency, and reliability advantages of a centralized registry. It details how GitLab users can manage Helm charts with features like vulnerability scanning, centralized permission management, SSO/SAML, and deploy tokens. The post also provides guidance on getting started and contributing to the Helm Registry's development.
  23. Using the Dependency Proxy to improve your pipelinesThis post details the enhancements to the GitLab Dependency Proxy, including its move to Core (open source), support for private groups, and the introduction of authentication mechanisms. It explains how the Dependency Proxy works by acting as a proxy for Docker registries, caching manifests and blobs to mitigate Docker Hub rate limiting. It also describes how to use predefined CI/CD variables (`CI_DEPENDENCY_PROXY_USER`, `CI_DEPENDENCY_PROXY_PASSWORD`, `CI_DEPENDENCY_PROXY_SERVER`, `CI_DEPENDENCY_PROXY_GROUP_IMAGE_PREFIX`, `CI_DEPENDENCY_PROXY_DIRECT_GROUP_IMAGE_PREFIX`) for authentication and image pulling within CI/CD pipelines. The post also covers how the Dependency Proxy can help maintain pipeline uptime during Docker Hub outages.
  24. How to cache Docker images and reduce Hub calls in CI/CDThis post details how to set up a Docker registry mirror to reduce Docker Hub pull requests, which is particularly relevant given Docker's new subscription model and rate limits. It provides instructions for both GitLab SaaS users (who are unaffected due to Google's mirror) and self-hosted GitLab Runner users, including steps to set up and configure a Docker Hub mirror and authenticate pulls as an alternative.
  25. The Dependency Proxy is moving to open sourceThis post announces that the Dependency Proxy will be made free for all GitLab users starting in version 13.6 to address Docker Hub rate limits. It details several in-progress issues and bug fixes related to the Dependency Proxy's functionality, including support for private groups, offline caching, and resolving specific storage configuration bugs. It also outlines upcoming work to support npm packages.
  26. Packaging now standard, dependency proxy next?This post announces the upcoming Dependency Proxy feature, which will enhance security and audibility for package users by allowing blocking and delaying of suspect packages and tracing vulnerable package usage. It also highlights GitLab's existing integrated container registry and artifact repositories, and its broader DevOps lifecycle capabilities, contrasting with GitHub's new package registry. The post mentions the plans for adding further packaging capabilities on the public packaging roadmap.
  27. Introducing GitLab Container RegistryThis post introduces the GitLab Container Registry, a new feature integrated with GitLab 8.8. It provides a secure, private registry for Docker images, leveraging GitLab's authentication and repository management. Key features include seamless integration with GitLab CI/CD for building, pushing, and deploying images, project-specific image repositories, and a dedicated 'Container Registry' tab in projects. It simplifies Docker workflows by eliminating the need for separate registry services and allows for easy management of image tags.