ContainerRegistry
Storing and versioning container images (Docker Hub, ECR, GHCR) — tagging strategy, vulnerability scanning.
Why we need this / what value this brings
Versioned, scanned images are what make deploys reproducible and let you roll back to a known-good image.
When to use this
As soon as images are being deployed anywhere beyond local docker compose up.
How to use or implement this
Tag images with something traceable (git SHA or semver), and enable vulnerability scanning on push if the registry supports it.
Research questions
- What's the image-tagging convention once this moves beyond
docker compose uplocally (git SHA? semver?)?
Empty folder — drop notes, links, and findings here as you research.