Docker Registries Deployment Patterns

Patterns pour builder, signer, scanner et pousser des images Docker vers les principaux registries en 2025.

1. Docker Hub

Setup

docker login

# Tag
docker build -t myorg/myapp:1.0.0 .
docker tag myorg/myapp:1.0.0 myorg/myapp:latest

# Push
docker push myorg/myapp:1.0.0
docker push myorg/myapp:latest

Plans Docker Hub

• Personal — 1 private repo gratuit, unlimited public
• Pro — $9/mo, plus de private repos
• Team — $15/user/mo
• Business — $24/user/mo

Rate limits pour anonymous pulls : 100 pulls / 6h / IP → utiliser un login même pour pull public.

2. GHCR (GitHub Container Registry)

Setup

# Login avec PAT (scope write:packages)
echo $GITHUB_TOKEN | docker login ghcr.io -u USERNAME --password-stdin

# Tag
docker tag myapp:latest ghcr.io/username/myapp:1.0.0

# Push
docker push ghcr.io/username/myapp:1.0.0

GitHub Actions (automatisé)

# .github/workflows/docker-publish.yml
name: Build and push Docker image

on:
  push:
    branches: [main]
    tags: ['v*']

jobs:
  build:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    steps:
      - uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log in to GHCR
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract metadata
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ghcr.io/${{ github.repository }}
          tags: |
            type=ref,event=branch
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=sha,prefix=sha-

      - name: Build and push
        uses: docker/build-push-action@v5
        with:
          context: .
          platforms: linux/amd64,linux/arm64
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

Avantages GHCR :

• Gratuit pour public + private dans les repos GitHub
• GITHUB_TOKEN auto-fourni, pas de PAT custom
• Intégration native avec GitHub Packages UI
• Pas de rate limit sur les pulls pour les users authentifiés

3. AWS ECR

ECR Private

# Login via AWS CLI
aws ecr get-login-password --region eu-west-3 | \
  docker login --username AWS --password-stdin 123456789012.dkr.ecr.eu-west-3.amazonaws.com

# Créer un repo (une fois)
aws ecr create-repository --repository-name myapp --region eu-west-3

# Tag + push
docker tag myapp:latest 123456789012.dkr.ecr.eu-west-3.amazonaws.com/myapp:1.0.0
docker push 123456789012.dkr.ecr.eu-west-3.amazonaws.com/myapp:1.0.0

ECR Public Gallery

Pour des images publiques hébergées sur AWS gratuitement :

aws ecr-public get-login-password --region us-east-1 | \
  docker login --username AWS --password-stdin public.ecr.aws

docker tag myapp:latest public.ecr.aws/myorg/myapp:1.0.0
docker push public.ecr.aws/myorg/myapp:1.0.0

GitHub Actions avec OIDC (pas de long-lived credentials)

- name: Configure AWS credentials
  uses: aws-actions/configure-aws-credentials@v4
  with:
    role-to-assume: arn:aws:iam::123456789012:role/gh-actions-ecr
    aws-region: eu-west-3

- name: Login to ECR
  uses: aws-actions/amazon-ecr-login@v2

Configurer l'IAM role avec trust policy GitHub OIDC pour éviter les AWS_ACCESS_KEY_ID dans les secrets.

4. Google Artifact Registry (GAR)

GCR est déprécié en 2024+ → utiliser Artifact Registry.

# Auth via gcloud
gcloud auth configure-docker europe-west1-docker.pkg.dev

# Créer un repo
gcloud artifacts repositories create myapp-repo \
  --repository-format=docker \
  --location=europe-west1 \
  --description="My app images"

# Tag + push
docker tag myapp:latest europe-west1-docker.pkg.dev/my-gcp-project/myapp-repo/myapp:1.0.0
docker push europe-west1-docker.pkg.dev/my-gcp-project/myapp-repo/myapp:1.0.0

5. Azure Container Registry (ACR)

# Login
az acr login --name myregistry

# Créer un ACR (une fois)
az acr create --resource-group myRG --name myregistry --sku Basic

# Tag + push
docker tag myapp:latest myregistry.azurecr.io/myapp:1.0.0
docker push myregistry.azurecr.io/myapp:1.0.0

6. GitLab Container Registry

Intégré gratuitement dans chaque project GitLab :

# Login via CI/CD token
docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY

# Tag
docker tag myapp:latest $CI_REGISTRY_IMAGE:$CI_COMMIT_TAG

# Push
docker push $CI_REGISTRY_IMAGE:$CI_COMMIT_TAG

Les variables $CI_REGISTRY* sont auto-injectées dans les jobs GitLab CI.

7. Multi-arch builds (amd64 + arm64)

En 2025, les M1/M2/M3 Macs et AWS Graviton nécessitent des images linux/arm64. Les serveurs classiques restent linux/amd64.

# Setup buildx
docker buildx create --use --name multiarch

# Build multi-arch en un seul push
docker buildx build \
  --platform linux/amd64,linux/arm64 \
  --tag myorg/myapp:1.0.0 \
  --push \
  .

Dockerfile cross-platform-friendly

FROM --platform=$BUILDPLATFORM node:20-alpine AS builder
ARG TARGETPLATFORM

WORKDIR /app
COPY package.json pnpm-lock.yaml ./
RUN corepack enable && pnpm install --frozen-lockfile
COPY . .
RUN pnpm build

FROM node:20-alpine AS runner
WORKDIR /app
COPY --from=builder /app/dist ./dist
COPY --from=builder /app/node_modules ./node_modules
CMD ["node", "dist/index.js"]

$BUILDPLATFORM = la plateforme de la machine qui build (rapide), $TARGETPLATFORM = la plateforme cible.

8. Image signing (cosign)

# Install cosign
brew install cosign  # macOS
# ou https://docs.sigstore.dev/cosign/installation/

# Générer une paire de clés
cosign generate-key-pair

# Signer
cosign sign --key cosign.key myorg/myapp:1.0.0

# Vérifier
cosign verify --key cosign.pub myorg/myapp:1.0.0

Keyless signing (recommandé depuis Sigstore 2024)

# Signer avec OIDC identity (GitHub, Google, Microsoft)
cosign sign myorg/myapp:1.0.0
# → ouvre un navigateur pour OAuth
# → signature stockée dans Rekor transparency log

Dans GitHub Actions :

- uses: sigstore/cosign-installer@v3
- run: cosign sign --yes ghcr.io/${{ github.repository }}:${{ github.sha }}
  env:
    COSIGN_EXPERIMENTAL: "true"

9. Vulnerability scanning

Trivy (gratuit, open source)

# Install
brew install aquasecurity/trivy/trivy

# Scan
trivy image myorg/myapp:1.0.0

# Fail si HIGH ou CRITICAL
trivy image --severity HIGH,CRITICAL --exit-code 1 myorg/myapp:1.0.0

En GitHub Actions :

- name: Scan image with Trivy
  uses: aquasecurity/trivy-action@master
  with:
    image-ref: ghcr.io/${{ github.repository }}:${{ github.sha }}
    format: sarif
    output: trivy-results.sarif
    severity: HIGH,CRITICAL
    exit-code: 1

Docker Scout (intégré Docker Desktop)

docker scout cves myorg/myapp:1.0.0
docker scout recommendations myorg/myapp:1.0.0

Snyk (payant pour le free tier limité)

snyk container test myorg/myapp:1.0.0
snyk container monitor myorg/myapp:1.0.0

10. Tag conventions

Tag	Usage
latest	À éviter en prod — pointe vers le dernier push, pas immuable
1.2.3 (semver)	Version stable immuable
1.2 (minor)	Auto-update vers le dernier patch
1 (major)	Auto-update vers le dernier minor.patch
sha-abc1234 (commit)	Reproducible, utile en CI
main / develop	Dernier build de la branche
pr-123	Build par PR

Règle prod : déployer avec un tag immuable (1.2.3 ou sha-abc1234), jamais latest.

Anti-patterns

1. latest en prod → surprise au prochain docker pull, pas de reproductibilité
2. Secrets dans le Dockerfile — ARG SECRET=xxx apparaît dans l'image finale
3. Pas de .dockerignore → upload node_modules, .git, secrets
4. Image sans USER non-root → security issue
5. Cache non utilisé → builds lents en CI, coût élevé
6. Pas de scan vulnerability → CVE en prod
7. Pas de signing sur images critiques → supply chain attack possible
8. Single-arch uniquement (amd64) → cassé sur M1 Macs et Graviton
9. Tags mutables → myapp:prod qui change chaque deploy, difficile à rollback

Checklist

• Registry choisi (GHCR si GitHub-native, ECR si AWS, etc.)
• Dockerfile multi-stage avec USER non-root
• .dockerignore committé
• Multi-arch (amd64 + arm64) si déploiement hétérogène
• Cache CI activé (gha, ecr, gcb)
• Scan vulnerability en CI (Trivy ou équivalent)
• Signing cosign pour images prod
• Tag semver + sha (pas latest en prod)
• Rate limits évités (login avant pull sur Docker Hub)
• Secrets CI via OIDC quand possible (AWS, GCP, Azure)

Quand déléguer

• Déployer le container (après push) → skills deploy-railway, deploy-fly, deploy-cloudflare
• Kubernetes → agents devops-expert
• Supply chain security audit → security-reviewer + supply-chain-risk-auditor

Ressources

• https://docs.docker.com/build/
• https://docs.docker.com/buildx/working-with-buildx/
• https://docs.github.com/en/packages/working-with-a-github-packages-registry/working-with-the-container-registry
• https://docs.sigstore.dev/cosign/overview/
• https://trivy.dev/