Skip to main content

Artifact Registry

1 - Overview​

Artifact Registry is Google Cloud's unified service for storing and managing build artifacts.

2 - Repository types​

TypeFormatUsage
DockerContainer imagesContainers
npmJavaScript packagesNode.js
MavenJava artifactsJava/Kotlin
PythonPip packagesPython
AptDebian packagesLinux
YumRPM packagesLinux
GoGo modulesGo

3 - Create a repository​

3.1 Docker repository​

# Create a Docker repo
gcloud artifacts repositories create images \
    --repository-format=docker \
    --location=europe-west1 \
    --description="Docker images"

# List repos
gcloud artifacts repositories list --location=europe-west1

# Configure Docker to use AR
gcloud auth configure-docker europe-west1-docker.pkg.dev

3.2 npm repository​

# Create an npm repo
gcloud artifacts repositories create npm-packages \
    --repository-format=npm \
    --location=europe-west1 \
    --description="npm packages"

3.3 Python repository​

# Create a Python repo
gcloud artifacts repositories create python-packages \
    --repository-format=python \
    --location=europe-west1 \
    --description="Python packages"

4 - Docker images​

4.1 Push an image​

# Tag the image
docker tag mon-app:latest \
    europe-west1-docker.pkg.dev/mon-projet/images/mon-app:v1.0.0

# Push
docker push europe-west1-docker.pkg.dev/mon-projet/images/mon-app:v1.0.0

4.2 Pull an image​

docker pull europe-west1-docker.pkg.dev/mon-projet/images/mon-app:v1.0.0

4.3 In Cloud Build​

# cloudbuild.yaml
steps:
  - name: 'gcr.io/cloud-builders/docker'
    args:
      - 'build'
      - '-t'
      - 'europe-west1-docker.pkg.dev/$PROJECT_ID/images/app:$COMMIT_SHA'
      - '-t'
      - 'europe-west1-docker.pkg.dev/$PROJECT_ID/images/app:latest'
      - '.'

images:
  - 'europe-west1-docker.pkg.dev/$PROJECT_ID/images/app:$COMMIT_SHA'
  - 'europe-west1-docker.pkg.dev/$PROJECT_ID/images/app:latest'

5 - npm Packages​

5.1 .npmrc configuration​

# Generate the config
gcloud artifacts print-settings npm \
    --project=mon-projet \
    --repository=npm-packages \
    --location=europe-west1
# .npmrc
@monorg:registry=https://europe-west1-npm.pkg.dev/mon-projet/npm-packages/
//europe-west1-npm.pkg.dev/mon-projet/npm-packages/:always-auth=true

5.2 Authentication​

# Via gcloud (for local development)
npx google-artifactregistry-auth

# Or via token
gcloud artifacts print-settings npm \
    --scope=@monorg \
    --project=mon-projet \
    --repository=npm-packages \
    --location=europe-west1 \
    --json-key=service-account.json

5.3 Publish a package​

npm publish

5.4 In Cloud Build​

steps:
  - name: 'gcr.io/cloud-builders/npm'
    args: ['ci']
  
  - name: 'gcr.io/cloud-builders/npm'
    args: ['publish']
    env:
      - 'NPM_TOKEN=${_NPM_TOKEN}'

6 - Python Packages​

6.1 pip configuration​

# Generate the config
gcloud artifacts print-settings python \
    --project=mon-projet \
    --repository=python-packages \
    --location=europe-west1

6.2 pip.conf​

[global]
extra-index-url = https://europe-west1-python.pkg.dev/mon-projet/python-packages/simple/

6.3 Publish with twine​

# Install twine
pip install twine

# Build
python setup.py sdist bdist_wheel

# Publish
twine upload --repository-url \
    https://europe-west1-python.pkg.dev/mon-projet/python-packages/ \
    dist/*

7 - Vulnerability Scanning​

7.1 Enable scanning​

# Enable the Container Analysis API
gcloud services enable containeranalysis.googleapis.com

# Scanning is automatic for Docker images

7.2 View vulnerabilities​

# Via CLI
gcloud artifacts docker images list \
    europe-west1-docker.pkg.dev/mon-projet/images \
    --show-occurrences

# Details of an image
gcloud artifacts docker images describe \
    europe-west1-docker.pkg.dev/mon-projet/images/app:v1.0.0 \
    --show-all-metadata

7.3 Block vulnerable images​

# In GKE with Binary Authorization
apiVersion: binaryauthorization.google.com/v1
kind: Policy
spec:
  defaultAdmissionRule:
    evaluationMode: REQUIRE_ATTESTATION
    enforcementMode: ENFORCED_BLOCK_AND_AUDIT_LOG

8 - Cleanup Policies​

8.1 Configure retention​

# Create a cleanup policy
gcloud artifacts repositories set-cleanup-policies images \
    --location=europe-west1 \
    --policy=cleanup-policy.json
// cleanup-policy.json
{
  "name": "delete-old-images",
  "action": {"type": "Delete"},
  "condition": {
    "tagState": "UNTAGGED",
    "olderThan": "30d"
  }
}

8.2 Tag-based retention policy​

{
  "name": "keep-recent-versions",
  "action": {"type": "Keep"},
  "condition": {
    "tagPrefixes": ["release-", "v"],
    "newerThan": "90d"
  },
  "mostRecentVersions": {
    "keepCount": 10
  }
}

9 - Remote Repositories​

Caching of external registries.

# Create a remote repo for Docker Hub
gcloud artifacts repositories create docker-hub-cache \
    --repository-format=docker \
    --location=europe-west1 \
    --mode=remote-repository \
    --remote-repo-config-desc="Docker Hub cache" \
    --remote-docker-repo=DOCKER-HUB

# Use the cache
docker pull europe-west1-docker.pkg.dev/mon-projet/docker-hub-cache/nginx:latest

Summary​

In this chapter, we learned:

  • The repository types
  • Managing Docker images
  • npm and Python packages
  • Vulnerability Scanning
  • Cleanup Policies
  • Remote Repositories

Next step​

In the next chapter, we will look at Cloud Deploy.

→ Next chapter: Cloud Deploy

← Back to table of contents