> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tensor9.com/llms.txt
> Use this file to discover all available pages before exploring further.

# ECR

> ECR APIs with Cloud Adapter.

This page describes how ECR maps to services in the environment where the application runs, including backend choices, supported operations and service-specific behavior.

## Supported environments

* Akamai
* Azure
* DigitalOcean
* Google Cloud
* OCI
* Private Kubernetes
* Scaleway

Check the operation and capability tables for the behavior your application depends on. A supported environment does not imply that every operation of the origin service is available.

## How the backends compare

Each row compares a capability of ECR with its adaptation on each backend.
A dash means this profile does not state the capability for that backend.

### Cloud Adapter

| Capability | ECR | Akamai and Private Kubernetes · Zot Registry | Akamai and Private Kubernetes · Distribution Registry | Azure | DigitalOcean | Google Cloud | OCI | Private Kubernetes · Harbor Registry | Scaleway |
| - | - | - | - | - | - | - | - | - | - |
| Repository topology · repository organization | ECR: repositories within an account-and-region registry | in-cluster: the ECR repository set becomes the registry's repositories/namespaces (N to N) | in-cluster: the ECR repository set becomes the registry's repositories/namespaces (N to N) | ACR: one provisioned registry contains distinct repository paths; image references change | - | Artifact Registry: one Docker-format repository per ECR repository (N to N), topology preserved | OCIR: one repository per ECR repository (N to N), repository organization preserved | in-cluster: the ECR repository set becomes the registry's repositories/namespaces (N to N) | - |
| Tag immutability | Yes - image\_tag\_mutability | Partial - Zot has no per-repo immutable-tag lock | No - Distribution has no immutable-tag control | - | - | Yes - IMMUTABLE\_TAGS setting | Yes - is\_immutable per-repo flag | Yes - Harbor immutable-tag rules (per-repo) | - |
| Lifecycle / retention · scope | ECR: per-repository expiry rules | Zot retention policies (registry-level) | Distribution offers blob garbage-collection only, not tag/age retention | ACR: registry-wide retention (Premium tier), a scope change that is surfaced | - | per-repository keep/delete rules; the bounded single-image-package count/age mapping does not preserve the full ECR policy | OCIR: image retention policies, region-wide by default and overridable per repository, surfaced at the build | Harbor tag-retention is per-repository, the closest in-cluster analog to ECR lifecycle rules | - |
| Vulnerability scanning | Yes - ECR enhanced (Inspector) | Partial - Zot exposes CVE search via an optional Trivy-DB extension (not built-in scan-on-push) | No - CNCF Distribution has no built-in vulnerability scanner | Partial - Microsoft Defender for Containers: native scanner, different coverage | - | Partial - Container Analysis: on-push + continuous | Partial - OCI Vulnerability Scanning: native scanner, different coverage | Partial - Harbor ships a built-in Trivy integration (scan-on-push) | - |
| Data path · managed vs in-cluster | ECR: AWS-managed registry | in-cluster registry starts empty: deploy + load (via the Cloud Adapter deployment) + rewrite refs; no pull-through to AWS | in-cluster registry starts empty: deploy + load (via the Cloud Adapter deployment) + rewrite refs; no pull-through to AWS | - | - | - | - | in-cluster registry starts empty: deploy + load (via the Cloud Adapter deployment) + rewrite refs; no pull-through to AWS | - |
| API coverage | full | high | high | high | partial | high | high | high | partial |
| Tag immutability | Yes - per-repo image\_tag\_mutability | - | - | Partial - image and repository write locks; different from ECR tag immutability | - | - | - | - | - |

## On Akamai and Private Kubernetes

### Zot Registry

| Operation | Area | Support | Depth | Notes |
| - | - | - | - | - |
| Registry authentication | Auth | Supported | Common | in-cluster imagePullSecret; Harbor also supports robot accounts |
| Reference rewrite | Image path | Supported | Common | every consumer's ECR image ref is rewritten to the in-cluster host; the imagePullSecret is injected and the ECR auth helper dropped |
| docker push / pull | Image path | Supported | Common | byte-identical OCI Distribution v2; the host changes to registry.\<ns>.svc |
| Lifecycle policy mapping | Lifecycle | Partial | Most usage | Zot retention policies (registry-level) |
| Image load (bootstrap) | Migration | Supported | Common | The Cloud Adapter deployment loads images before workloads pull them. Images are identified by content, so repeating the load does not duplicate them. |
| Cross-region replication | Replication | Out of scope | Full surface | an in-cluster registry has no cross-region replica; the pull-through cache to ECR is deliberately not used, so there is no outbound AWS dependency |
| Repository provisioning | Repositories | Supported | Common | the registry is deployed in-cluster and the ECR repository set becomes its repositories/namespaces (N to N) |
| Scan-on-push findings | Scanning | Partial | Most usage | Zot exposes CVE search via an optional Trivy-DB extension (not built-in scan-on-push) |

#### How it works

On AWS your build pushes container images to **Amazon ECR** and your workloads pull from it. When the target is your own **Kubernetes cluster**, the registry runs inside the cluster: an open-source registry you operate, with no cloud registry service behind it. Harbor is the recommended registry; Zot is a smaller alternative; Distribution provides basic image storage and delivery. At the build, Tensor9 provisions the registry, loads your images into it through the Cloud Adapter deployment, and rewrites every image reference to the in-cluster host; afterward your workloads pull directly from it.

The image itself never changes. ECR and the in-cluster registry both speak the **OCI Distribution v2** protocol, so your image manifest, its layer blobs, and their content digests are byte-identical; docker and containerd are untouched. The one thing rewritten at the build is the registry address: your ECR host becomes `registry.<ns>.svc`. You operate the registry and configure its policies.

This mapping provisions a target registry and updates image references. Docker and containerd use the target registry's own protocol and credentials. It does not provide the AWS ECR management or authorization-token API: an application that calls ECR directly, including `GetAuthorizationToken`, needs a separate integration.

![Before: on AWS your build pushes images to Amazon ECR and your workloads pull from it. After: on the target cloud the same docker push and pull reach in-cluster registry, provisioned at the build. Only the registry address is rewritten; the image is unchanged and Tensor9 is not in the pull path.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMTg0IiB2aWV3Qm94PSIwIDAgODM2IDE4NCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJCZWZvcmU6IG9uIEFXUyB5b3VyIGJ1aWxkIHB1c2hlcyBpbWFnZXMgdG8gQW1hem9uIEVDUiBhbmQgeW91ciB3b3JrbG9hZHMgcHVsbCBmcm9tIGl0LiBBZnRlcjogb24gdGhlIHRhcmdldCBjbG91ZCB0aGUgc2FtZSBkb2NrZXIgcHVzaCBhbmQgcHVsbCByZWFjaCBpbi1jbHVzdGVyIHJlZ2lzdHJ5LCBwcm92aXNpb25lZCBhdCB0aGUgYnVpbGQuIE9ubHkgdGhlIHJlZ2lzdHJ5IGFkZHJlc3MgaXMgcmV3cml0dGVuOyB0aGUgaW1hZ2UgaXMgdW5jaGFuZ2VkIGFuZCBUZW5zb3I5IGlzIG5vdCBpbiB0aGUgcHVsbCBwYXRoLiI+PHN0eWxlPnRleHR7Zm9udC1mYW1pbHk6SW50ZXIsLWFwcGxlLXN5c3RlbSxCbGlua01hY1N5c3RlbUZvbnQsJ1NlZ29lIFVJJyxSb2JvdG8sJ0hlbHZldGljYSBOZXVlJyxBcmlhbCxzYW5zLXNlcmlmO2ZpbGw6IzMzNDE1NX08L3N0eWxlPgo8ZGVmcz48bWFya2VyIGlkPSJlY3Jody1pbmNsdXN0ZXIiIHZpZXdCb3g9IjAgMCAxMCAxMCIgcmVmWD0iOCIgcmVmWT0iNSIgbWFya2VyV2lkdGg9IjciIG1hcmtlckhlaWdodD0iNyIgb3JpZW50PSJhdXRvLXN0YXJ0LXJldmVyc2UiPjxwYXRoIGQ9Ik0wLDAgTDEwLDUgTDAsMTAgeiIgc3R5bGU9ImZpbGw6Izk0YTNiOCIvPjwvbWFya2VyPjwvZGVmcz4KPHJlY3QgeD0iMTYiIHk9IjQwIiB3aWR0aD0iMzU4IiBoZWlnaHQ9IjEyMCIgcng9IjE0IiBzdHJva2Utd2lkdGg9IjEuNCIgc3Ryb2tlLWRhc2hhcnJheT0iNSA1IiBzdHlsZT0iZmlsbDojZjhmYWZjO3N0cm9rZTojY2JkNWUxIi8+Cjx0ZXh0IHg9IjMwIiB5PSI2MCIgc3R5bGU9ImZvbnQ6IDcwMCAxMHB4IEludGVyLCBzYW5zLXNlcmlmOyBsZXR0ZXItc3BhY2luZzogMS4zcHg7IGZpbGw6ICM5NGEzYjg7IGZpbGw6IzY0NzQ4YiI+T04gQVdTIFRPREFZPC90ZXh0Pgo8cmVjdCB4PSIzMCIgeT0iNzgiIHdpZHRoPSIxMTgiIGhlaWdodD0iNjAiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0eWxlPSJmaWxsOiNmZmZmZmY7c3Ryb2tlOiNjYmQ1ZTEiLz4KPHRleHQgeD0iODkiIHk9IjEwNCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwZjE3MmE7IGZvbnQtc2l6ZToxMnB4Ij5idWlsZCAvIHBvZHM8L3RleHQ+Cjx0ZXh0IHg9Ijg5IiB5PSIxMjIiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiIj5kb2NrZXIgcHVzaCAvIHB1bGw8L3RleHQ+CjxsaW5lIHgxPSIxNDgiIHkxPSIxMDgiIHgyPSIyMDYiIHkyPSIxMDgiIHN0cm9rZS13aWR0aD0iMiIgbWFya2VyLWVuZD0idXJsKCNlY3Jody1pbmNsdXN0ZXIpIiBzdHlsZT0ic3Ryb2tlOiM5NGEzYjgiLz4KPHJlY3QgeD0iMjEwIiB5PSI3OCIgd2lkdGg9IjE1MCIgaGVpZ2h0PSI2MCIgcng9IjExIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6I2ZmZmZmZjtzdHJva2U6I2NiZDVlMSIvPgo8dGV4dCB4PSIyODUiIHk9IjEwNCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwZjE3MmE7IGZvbnQtc2l6ZToxMnB4Ij5BbWF6b24gRUNSPC90ZXh0Pgo8dGV4dCB4PSIyODUiIHk9IjEyMiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGIiPkFXUy1tYW5hZ2VkPC90ZXh0Pgo8dGV4dCB4PSI0MTgiIHk9IjMwIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTAuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMDQ3ODU3OyBmb250LXdlaWdodDo3MDAiPnNldCB1cCBhdCB0aGUgYnVpbGQ8L3RleHQ+CjxyZWN0IHg9IjQ2MiIgeT0iNDAiIHdpZHRoPSIzNjIiIGhlaWdodD0iMTIwIiByeD0iMTQiIHN0cm9rZS13aWR0aD0iMS40IiBzdHJva2UtZGFzaGFycmF5PSI1IDUiIHN0eWxlPSJmaWxsOiNmOGZhZmM7c3Ryb2tlOiNjYmQ1ZTEiLz4KPHRleHQgeD0iNDc2IiB5PSI2MCIgc3R5bGU9ImZvbnQ6IDcwMCAxMHB4IEludGVyLCBzYW5zLXNlcmlmOyBsZXR0ZXItc3BhY2luZzogMS4zcHg7IGZpbGw6ICM5NGEzYjg7IGZpbGw6IzA0Nzg1NyI+SU4gS1VCRVJORVRFUyBDTFVTVEVSPC90ZXh0Pgo8cmVjdCB4PSI0NzYiIHk9Ijc4IiB3aWR0aD0iMTA0IiBoZWlnaHQ9IjYwIiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojZmZmZmZmO3N0cm9rZTojY2JkNWUxIi8+Cjx0ZXh0IHg9IjUyOCIgeT0iMTA0IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzBmMTcyYTsgZm9udC1zaXplOjEycHgiPmJ1aWxkIC8gcG9kczwvdGV4dD4KPHRleHQgeD0iNTI4IiB5PSIxMjIiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2MDAgMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzA0Nzg1NyI+c2FtZSBjb21tYW5kczwvdGV4dD4KPGxpbmUgeDE9IjU4MCIgeTE9IjEwOCIgeDI9IjYxNiIgeTI9IjEwOCIgc3Ryb2tlLXdpZHRoPSIyIiBtYXJrZXItZW5kPSJ1cmwoI2Vjcmh3LWluY2x1c3RlcikiIHN0eWxlPSJzdHJva2U6Izk0YTNiOCIvPgo8cmVjdCB4PSI2MjAiIHk9Ijc0IiB3aWR0aD0iMTg4IiBoZWlnaHQ9IjY4IiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS43IiBzdHlsZT0iZmlsbDojZWNmZGY1O3N0cm9rZTojMDQ3ODU3Ii8+Cjx0ZXh0IHg9IjcxNCIgeT0iOTkiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA3MDAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMDQ3ODU3OyBmb250LXNpemU6MTEuNXB4Ij5pbi1jbHVzdGVyIHJlZ2lzdHJ5PC90ZXh0Pgo8dGV4dCB4PSI3MTQiIHk9IjExNSIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICM2NDc0OGIiPnJlZ2lzdHJ5LiZsdDtucyZndDsuc3ZjPC90ZXh0Pgo8dGV4dCB4PSI3MTQiIHk9IjEzMSIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzA0Nzg1NyI+eW91IG9wZXJhdGUgaXQsIGluLWNsdXN0ZXI8L3RleHQ+Cjx0ZXh0IHg9IjY0MyIgeT0iMTc2IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTAuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMDQ3ODU3OyBmb250LXdlaWdodDo3MDAiPlRlbnNvcjkgaXMgbm90IGluIHRoZSBwdWxsIHBhdGg8L3RleHQ+Cjwvc3ZnPg==)

![Before: on AWS your build pushes images to Amazon ECR and your workloads pull from it. After: on the target cloud the same docker push and pull reach in-cluster registry, provisioned at the build. Only the registry address is rewritten; the image is unchanged and Tensor9 is not in the pull path.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMTg0IiB2aWV3Qm94PSIwIDAgODM2IDE4NCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJCZWZvcmU6IG9uIEFXUyB5b3VyIGJ1aWxkIHB1c2hlcyBpbWFnZXMgdG8gQW1hem9uIEVDUiBhbmQgeW91ciB3b3JrbG9hZHMgcHVsbCBmcm9tIGl0LiBBZnRlcjogb24gdGhlIHRhcmdldCBjbG91ZCB0aGUgc2FtZSBkb2NrZXIgcHVzaCBhbmQgcHVsbCByZWFjaCBpbi1jbHVzdGVyIHJlZ2lzdHJ5LCBwcm92aXNpb25lZCBhdCB0aGUgYnVpbGQuIE9ubHkgdGhlIHJlZ2lzdHJ5IGFkZHJlc3MgaXMgcmV3cml0dGVuOyB0aGUgaW1hZ2UgaXMgdW5jaGFuZ2VkIGFuZCBUZW5zb3I5IGlzIG5vdCBpbiB0aGUgcHVsbCBwYXRoLiI+PHN0eWxlPnRleHR7Zm9udC1mYW1pbHk6SW50ZXIsLWFwcGxlLXN5c3RlbSxCbGlua01hY1N5c3RlbUZvbnQsJ1NlZ29lIFVJJyxSb2JvdG8sJ0hlbHZldGljYSBOZXVlJyxBcmlhbCxzYW5zLXNlcmlmO2ZpbGw6I2NiZDVlMX08L3N0eWxlPgo8ZGVmcz48bWFya2VyIGlkPSJlY3Jody1pbmNsdXN0ZXIiIHZpZXdCb3g9IjAgMCAxMCAxMCIgcmVmWD0iOCIgcmVmWT0iNSIgbWFya2VyV2lkdGg9IjciIG1hcmtlckhlaWdodD0iNyIgb3JpZW50PSJhdXRvLXN0YXJ0LXJldmVyc2UiPjxwYXRoIGQ9Ik0wLDAgTDEwLDUgTDAsMTAgeiIgc3R5bGU9ImZpbGw6IzY0NzQ4YiIvPjwvbWFya2VyPjwvZGVmcz4KPHJlY3QgeD0iMTYiIHk9IjQwIiB3aWR0aD0iMzU4IiBoZWlnaHQ9IjEyMCIgcng9IjE0IiBzdHJva2Utd2lkdGg9IjEuNCIgc3Ryb2tlLWRhc2hhcnJheT0iNSA1IiBzdHlsZT0iZmlsbDojMGYxNzJhO3N0cm9rZTojNDc1NTY5Ii8+Cjx0ZXh0IHg9IjMwIiB5PSI2MCIgc3R5bGU9ImZvbnQ6IDcwMCAxMHB4IEludGVyLCBzYW5zLXNlcmlmOyBsZXR0ZXItc3BhY2luZzogMS4zcHg7IGZpbGw6ICM2NDc0OGI7IGZpbGw6Izk0YTNiOCI+T04gQVdTIFRPREFZPC90ZXh0Pgo8cmVjdCB4PSIzMCIgeT0iNzgiIHdpZHRoPSIxMTgiIGhlaWdodD0iNjAiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0eWxlPSJmaWxsOiMxZTI5M2I7c3Ryb2tlOiM0NzU1NjkiLz4KPHRleHQgeD0iODkiIHk9IjEwNCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICNmMWY1Zjk7IGZvbnQtc2l6ZToxMnB4Ij5idWlsZCAvIHBvZHM8L3RleHQ+Cjx0ZXh0IHg9Ijg5IiB5PSIxMjIiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4Ij5kb2NrZXIgcHVzaCAvIHB1bGw8L3RleHQ+CjxsaW5lIHgxPSIxNDgiIHkxPSIxMDgiIHgyPSIyMDYiIHkyPSIxMDgiIHN0cm9rZS13aWR0aD0iMiIgbWFya2VyLWVuZD0idXJsKCNlY3Jody1pbmNsdXN0ZXIpIiBzdHlsZT0ic3Ryb2tlOiM2NDc0OGIiLz4KPHJlY3QgeD0iMjEwIiB5PSI3OCIgd2lkdGg9IjE1MCIgaGVpZ2h0PSI2MCIgcng9IjExIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6IzFlMjkzYjtzdHJva2U6IzQ3NTU2OSIvPgo8dGV4dCB4PSIyODUiIHk9IjEwNCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICNmMWY1Zjk7IGZvbnQtc2l6ZToxMnB4Ij5BbWF6b24gRUNSPC90ZXh0Pgo8dGV4dCB4PSIyODUiIHk9IjEyMiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjgiPkFXUy1tYW5hZ2VkPC90ZXh0Pgo8dGV4dCB4PSI0MTgiIHk9IjMwIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTAuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNmVlN2I3OyBmb250LXdlaWdodDo3MDAiPnNldCB1cCBhdCB0aGUgYnVpbGQ8L3RleHQ+CjxyZWN0IHg9IjQ2MiIgeT0iNDAiIHdpZHRoPSIzNjIiIGhlaWdodD0iMTIwIiByeD0iMTQiIHN0cm9rZS13aWR0aD0iMS40IiBzdHJva2UtZGFzaGFycmF5PSI1IDUiIHN0eWxlPSJmaWxsOiMwZjE3MmE7c3Ryb2tlOiM0NzU1NjkiLz4KPHRleHQgeD0iNDc2IiB5PSI2MCIgc3R5bGU9ImZvbnQ6IDcwMCAxMHB4IEludGVyLCBzYW5zLXNlcmlmOyBsZXR0ZXItc3BhY2luZzogMS4zcHg7IGZpbGw6ICM2NDc0OGI7IGZpbGw6IzZlZTdiNyI+SU4gS1VCRVJORVRFUyBDTFVTVEVSPC90ZXh0Pgo8cmVjdCB4PSI0NzYiIHk9Ijc4IiB3aWR0aD0iMTA0IiBoZWlnaHQ9IjYwIiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojMWUyOTNiO3N0cm9rZTojNDc1NTY5Ii8+Cjx0ZXh0IHg9IjUyOCIgeT0iMTA0IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogI2YxZjVmOTsgZm9udC1zaXplOjEycHgiPmJ1aWxkIC8gcG9kczwvdGV4dD4KPHRleHQgeD0iNTI4IiB5PSIxMjIiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2MDAgMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzZlZTdiNyI+c2FtZSBjb21tYW5kczwvdGV4dD4KPGxpbmUgeDE9IjU4MCIgeTE9IjEwOCIgeDI9IjYxNiIgeTI9IjEwOCIgc3Ryb2tlLXdpZHRoPSIyIiBtYXJrZXItZW5kPSJ1cmwoI2Vjcmh3LWluY2x1c3RlcikiIHN0eWxlPSJzdHJva2U6IzY0NzQ4YiIvPgo8cmVjdCB4PSI2MjAiIHk9Ijc0IiB3aWR0aD0iMTg4IiBoZWlnaHQ9IjY4IiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS43IiBzdHlsZT0iZmlsbDojMDY0ZTNiO3N0cm9rZTojNmVlN2I3Ii8+Cjx0ZXh0IHg9IjcxNCIgeT0iOTkiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA3MDAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNmVlN2I3OyBmb250LXNpemU6MTEuNXB4Ij5pbi1jbHVzdGVyIHJlZ2lzdHJ5PC90ZXh0Pgo8dGV4dCB4PSI3MTQiIHk9IjExNSIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICM5NGEzYjgiPnJlZ2lzdHJ5LiZsdDtucyZndDsuc3ZjPC90ZXh0Pgo8dGV4dCB4PSI3MTQiIHk9IjEzMSIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzZlZTdiNyI+eW91IG9wZXJhdGUgaXQsIGluLWNsdXN0ZXI8L3RleHQ+Cjx0ZXh0IHg9IjY0MyIgeT0iMTc2IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTAuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNmVlN2I3OyBmb250LXdlaWdodDo3MDAiPlRlbnNvcjkgaXMgbm90IGluIHRoZSBwdWxsIHBhdGg8L3RleHQ+Cjwvc3ZnPg==)

Your images are loaded into an in-cluster registry through the Cloud Adapter deployment at the build; afterward your workloads pull from it directly and the image is unchanged.

#### Registry features and operation

You operate the registry and configure the features of the software you choose. The registry is deployed empty : your images are loaded into it through the Cloud Adapter deployment's image delivery service before any workload pulls, and there is deliberately **no pull-through cache** back to ECR, which removes the outbound AWS dependency entirely.

**Harbor**, the recommended registry, ships built-in Trivy scan-on-push, robot accounts, per-repository retention, and immutable-tag rules, the closest match to ECR's registry-management features. **Zot** is lightweight and OCI-native, with vulnerability (CVE) search available through an optional extension. **Distribution** is the bare reference registry: it stores and delivers images and can garbage-collect unused layers, but has no scanning or tag controls. Whichever you run, your ECR repositories map one-to-one to the registry's repositories, and a workload pulls with an injected `imagePullSecret`; Harbor's robot accounts provide the richer, scoped path.

![In-cluster registry model](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjE2IiB2aWV3Qm94PSIwIDAgODM2IDIxNiIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJJbi1jbHVzdGVyIHJlZ2lzdHJ5IG1vZGVsIj48c3R5bGU+dGV4dHtmb250LWZhbWlseTpJbnRlciwtYXBwbGUtc3lzdGVtLEJsaW5rTWFjU3lzdGVtRm9udCwnU2Vnb2UgVUknLFJvYm90bywnSGVsdmV0aWNhIE5ldWUnLEFyaWFsLHNhbnMtc2VyaWY7ZmlsbDojMzM0MTU1fTwvc3R5bGU+Cjx0ZXh0IHg9IjIwIiB5PSIyNiIgc3R5bGU9ImZvbnQ6IDcwMCAxMHB4IEludGVyLCBzYW5zLXNlcmlmOyBsZXR0ZXItc3BhY2luZzogMS4zcHg7IGZpbGw6ICM5NGEzYjg7IGZpbGw6IzA0Nzg1NyI+SW4tY2x1c3RlciByZWdpc3RyeSBtb2RlbDwvdGV4dD4KPHJlY3QgeD0iMjAiIHk9IjQ0IiB3aWR0aD0iMjU2IiBoZWlnaHQ9IjY2IiByeD0iMTAiIHN0cm9rZS13aWR0aD0iMS40IiBzdHlsZT0iZmlsbDojZWNmZGY1O3N0cm9rZTojYTdmM2QwIi8+PHRleHQgeD0iMzYiIHk9IjcxIiBzdHlsZT0iZm9udDogNzAwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzA0Nzg1NzsgZm9udC1zaXplOjEycHgiPlNlbGYtbWFuYWdlZDwvdGV4dD48dGV4dCB4PSIzNiIgeT0iOTEiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiIj55b3Ugb3BlcmF0ZSB0aGUgcmVnaXN0cnk8L3RleHQ+PHJlY3QgeD0iMjk2IiB5PSI0NCIgd2lkdGg9IjI1NiIgaGVpZ2h0PSI2NiIgcng9IjEwIiBzdHJva2Utd2lkdGg9IjEuNCIgc3R5bGU9ImZpbGw6I2VjZmRmNTtzdHJva2U6I2E3ZjNkMCIvPjx0ZXh0IHg9IjMxMiIgeT0iNzEiIHN0eWxlPSJmb250OiA3MDAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMDQ3ODU3OyBmb250LXNpemU6MTJweCI+RGVwbG95ZWQgZW1wdHk8L3RleHQ+PHRleHQgeD0iMzEyIiB5PSI5MSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGIiPmltYWdlcyBsb2FkZWQgdmlhIHRoZSBhcHBsaWFuY2U8L3RleHQ+PHJlY3QgeD0iNTcyIiB5PSI0NCIgd2lkdGg9IjI1NiIgaGVpZ2h0PSI2NiIgcng9IjEwIiBzdHJva2Utd2lkdGg9IjEuNCIgc3R5bGU9ImZpbGw6I2VjZmRmNTtzdHJva2U6I2E3ZjNkMCIvPjx0ZXh0IHg9IjU4OCIgeT0iNzEiIHN0eWxlPSJmb250OiA3MDAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMDQ3ODU3OyBmb250LXNpemU6MTJweCI+SGFyYm9yIMK3IHJlY29tbWVuZGVkPC90ZXh0Pjx0ZXh0IHg9IjU4OCIgeT0iOTEiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiIj5Ucml2eSBzY2FuIMK3IHJvYm90IGFjY291bnRzPC90ZXh0PjxyZWN0IHg9IjIwIiB5PSIxMjgiIHdpZHRoPSIyNTYiIGhlaWdodD0iNjYiIHJ4PSIxMCIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0eWxlPSJmaWxsOiNlY2ZkZjU7c3Ryb2tlOiNhN2YzZDAiLz48dGV4dCB4PSIzNiIgeT0iMTU1IiBzdHlsZT0iZm9udDogNzAwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzA0Nzg1NzsgZm9udC1zaXplOjEycHgiPlpvdDwvdGV4dD48dGV4dCB4PSIzNiIgeT0iMTc1IiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YiI+bGlnaHR3ZWlnaHQsIE9DSS1uYXRpdmU8L3RleHQ+PHJlY3QgeD0iMjk2IiB5PSIxMjgiIHdpZHRoPSIyNTYiIGhlaWdodD0iNjYiIHJ4PSIxMCIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0eWxlPSJmaWxsOiNlY2ZkZjU7c3Ryb2tlOiNhN2YzZDAiLz48dGV4dCB4PSIzMTIiIHk9IjE1NSIgc3R5bGU9ImZvbnQ6IDcwMCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwNDc4NTc7IGZvbnQtc2l6ZToxMnB4Ij5EaXN0cmlidXRpb248L3RleHQ+PHRleHQgeD0iMzEyIiB5PSIxNzUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiIj5iYXJlIHJlZ2lzdHJ5LCBsYXllciBjbGVhbnVwPC90ZXh0PjxyZWN0IHg9IjU3MiIgeT0iMTI4IiB3aWR0aD0iMjU2IiBoZWlnaHQ9IjY2IiByeD0iMTAiIHN0cm9rZS13aWR0aD0iMS40IiBzdHlsZT0iZmlsbDojZWNmZGY1O3N0cm9rZTojYTdmM2QwIi8+PHRleHQgeD0iNTg4IiB5PSIxNTUiIHN0eWxlPSJmb250OiA3MDAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMDQ3ODU3OyBmb250LXNpemU6MTJweCI+UHVsbCBpZGVudGl0eTwvdGV4dD48dGV4dCB4PSI1ODgiIHk9IjE3NSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGIiPmltYWdlUHVsbFNlY3JldCAvIHJvYm90IGFjY291bnRzPC90ZXh0Pgo8L3N2Zz4=)

![In-cluster registry model](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjE2IiB2aWV3Qm94PSIwIDAgODM2IDIxNiIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJJbi1jbHVzdGVyIHJlZ2lzdHJ5IG1vZGVsIj48c3R5bGU+dGV4dHtmb250LWZhbWlseTpJbnRlciwtYXBwbGUtc3lzdGVtLEJsaW5rTWFjU3lzdGVtRm9udCwnU2Vnb2UgVUknLFJvYm90bywnSGVsdmV0aWNhIE5ldWUnLEFyaWFsLHNhbnMtc2VyaWY7ZmlsbDojY2JkNWUxfTwvc3R5bGU+Cjx0ZXh0IHg9IjIwIiB5PSIyNiIgc3R5bGU9ImZvbnQ6IDcwMCAxMHB4IEludGVyLCBzYW5zLXNlcmlmOyBsZXR0ZXItc3BhY2luZzogMS4zcHg7IGZpbGw6ICM2NDc0OGI7IGZpbGw6IzZlZTdiNyI+SW4tY2x1c3RlciByZWdpc3RyeSBtb2RlbDwvdGV4dD4KPHJlY3QgeD0iMjAiIHk9IjQ0IiB3aWR0aD0iMjU2IiBoZWlnaHQ9IjY2IiByeD0iMTAiIHN0cm9rZS13aWR0aD0iMS40IiBzdHlsZT0iZmlsbDojMDY0ZTNiO3N0cm9rZTojMDQ3ODU3Ii8+PHRleHQgeD0iMzYiIHk9IjcxIiBzdHlsZT0iZm9udDogNzAwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzZlZTdiNzsgZm9udC1zaXplOjEycHgiPlNlbGYtbWFuYWdlZDwvdGV4dD48dGV4dCB4PSIzNiIgeT0iOTEiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4Ij55b3Ugb3BlcmF0ZSB0aGUgcmVnaXN0cnk8L3RleHQ+PHJlY3QgeD0iMjk2IiB5PSI0NCIgd2lkdGg9IjI1NiIgaGVpZ2h0PSI2NiIgcng9IjEwIiBzdHJva2Utd2lkdGg9IjEuNCIgc3R5bGU9ImZpbGw6IzA2NGUzYjtzdHJva2U6IzA0Nzg1NyIvPjx0ZXh0IHg9IjMxMiIgeT0iNzEiIHN0eWxlPSJmb250OiA3MDAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNmVlN2I3OyBmb250LXNpemU6MTJweCI+RGVwbG95ZWQgZW1wdHk8L3RleHQ+PHRleHQgeD0iMzEyIiB5PSI5MSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjgiPmltYWdlcyBsb2FkZWQgdmlhIHRoZSBhcHBsaWFuY2U8L3RleHQ+PHJlY3QgeD0iNTcyIiB5PSI0NCIgd2lkdGg9IjI1NiIgaGVpZ2h0PSI2NiIgcng9IjEwIiBzdHJva2Utd2lkdGg9IjEuNCIgc3R5bGU9ImZpbGw6IzA2NGUzYjtzdHJva2U6IzA0Nzg1NyIvPjx0ZXh0IHg9IjU4OCIgeT0iNzEiIHN0eWxlPSJmb250OiA3MDAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNmVlN2I3OyBmb250LXNpemU6MTJweCI+SGFyYm9yIMK3IHJlY29tbWVuZGVkPC90ZXh0Pjx0ZXh0IHg9IjU4OCIgeT0iOTEiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4Ij5Ucml2eSBzY2FuIMK3IHJvYm90IGFjY291bnRzPC90ZXh0PjxyZWN0IHg9IjIwIiB5PSIxMjgiIHdpZHRoPSIyNTYiIGhlaWdodD0iNjYiIHJ4PSIxMCIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0eWxlPSJmaWxsOiMwNjRlM2I7c3Ryb2tlOiMwNDc4NTciLz48dGV4dCB4PSIzNiIgeT0iMTU1IiBzdHlsZT0iZm9udDogNzAwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzZlZTdiNzsgZm9udC1zaXplOjEycHgiPlpvdDwvdGV4dD48dGV4dCB4PSIzNiIgeT0iMTc1IiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiOCI+bGlnaHR3ZWlnaHQsIE9DSS1uYXRpdmU8L3RleHQ+PHJlY3QgeD0iMjk2IiB5PSIxMjgiIHdpZHRoPSIyNTYiIGhlaWdodD0iNjYiIHJ4PSIxMCIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0eWxlPSJmaWxsOiMwNjRlM2I7c3Ryb2tlOiMwNDc4NTciLz48dGV4dCB4PSIzMTIiIHk9IjE1NSIgc3R5bGU9ImZvbnQ6IDcwMCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2ZWU3Yjc7IGZvbnQtc2l6ZToxMnB4Ij5EaXN0cmlidXRpb248L3RleHQ+PHRleHQgeD0iMzEyIiB5PSIxNzUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4Ij5iYXJlIHJlZ2lzdHJ5LCBsYXllciBjbGVhbnVwPC90ZXh0PjxyZWN0IHg9IjU3MiIgeT0iMTI4IiB3aWR0aD0iMjU2IiBoZWlnaHQ9IjY2IiByeD0iMTAiIHN0cm9rZS13aWR0aD0iMS40IiBzdHlsZT0iZmlsbDojMDY0ZTNiO3N0cm9rZTojMDQ3ODU3Ii8+PHRleHQgeD0iNTg4IiB5PSIxNTUiIHN0eWxlPSJmb250OiA3MDAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNmVlN2I3OyBmb250LXNpemU6MTJweCI+UHVsbCBpZGVudGl0eTwvdGV4dD48dGV4dCB4PSI1ODgiIHk9IjE3NSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjgiPmltYWdlUHVsbFNlY3JldCAvIHJvYm90IGFjY291bnRzPC90ZXh0Pgo8L3N2Zz4=)

Choose the registry features your application needs: Harbor, Zot, or Distribution.

#### Limitations

Where ECR and an in-cluster registry stay different

* **Pulling through to ECR is not supported.** The registry starts empty. Your images are loaded through the Cloud Adapter deployment before any workload pulls; there is deliberately no pull-through cache back to ECR.
* **Scanning, immutability and retention behave differently: they depend on the registry you run.** Harbor supports most ECR management features, Zot some of them, and Distribution, a bare registry, none of them built in.
* **Cross-region replication is not supported.** An in-cluster registry is for the cluster it runs in. Images are loaded through the Cloud Adapter deployment, not replicated across regions.

#### Other considerations

Plan image delivery, credentials, and storage costs for the target registry.

* **Images are loaded through the Cloud Adapter deployment, then pulled locally.** The registry is deployed empty and your images are loaded through the Cloud Adapter deployment before any workload pulls. There is no pull-through cache back to ECR, so the running cluster does not depend on AWS.
* **You operate the registry.** There is no cloud service behind it. Harbor, Zot or Distribution is yours to run, and its availability, upgrades and access model are your responsibility.
* **Back up the registry's persistent volume.** The registry's image layers live on a PersistentVolume in the cluster, so backup and retention of the image store are yours.
* **Budget for cluster compute and storage.** The registry uses the cluster's own compute and storage rather than a managed per-tier or per-byte charge. Scanning, immutability and retention depend on which registry you chose.

### Distribution Registry

| Operation | Area | Support | Depth | Notes |
| - | - | - | - | - |
| Registry authentication | Auth | Supported | Common | in-cluster imagePullSecret; Harbor also supports robot accounts |
| Reference rewrite | Image path | Supported | Common | every consumer's ECR image ref is rewritten to the in-cluster host; the imagePullSecret is injected and the ECR auth helper dropped |
| docker push / pull | Image path | Supported | Common | byte-identical OCI Distribution v2; the host changes to registry.\<ns>.svc |
| Lifecycle policy mapping | Lifecycle | Partial | Most usage | Distribution offers blob garbage-collection only, not tag/age retention |
| Image load (bootstrap) | Migration | Supported | Common | The Cloud Adapter deployment loads images before workloads pull them. Images are identified by content, so repeating the load does not duplicate them. |
| Cross-region replication | Replication | Out of scope | Full surface | an in-cluster registry has no cross-region replica; the pull-through cache to ECR is deliberately not used, so there is no outbound AWS dependency |
| Repository provisioning | Repositories | Supported | Common | the registry is deployed in-cluster and the ECR repository set becomes its repositories/namespaces (N to N) |
| Scan-on-push findings | Scanning | Out of scope | Most usage | CNCF Distribution has no built-in vulnerability scanner |

#### How it works

On AWS your build pushes container images to **Amazon ECR** and your workloads pull from it. When the target is your own **Kubernetes cluster**, the registry runs inside the cluster: an open-source registry you operate, with no cloud registry service behind it. Harbor is the recommended registry; Zot is a smaller alternative; Distribution provides basic image storage and delivery. At the build, Tensor9 provisions the registry, loads your images into it through the Cloud Adapter deployment, and rewrites every image reference to the in-cluster host; afterward your workloads pull directly from it.

The image itself never changes. ECR and the in-cluster registry both speak the **OCI Distribution v2** protocol, so your image manifest, its layer blobs, and their content digests are byte-identical; docker and containerd are untouched. The one thing rewritten at the build is the registry address: your ECR host becomes `registry.<ns>.svc`. You operate the registry and configure its policies.

This mapping provisions a target registry and updates image references. Docker and containerd use the target registry's own protocol and credentials. It does not provide the AWS ECR management or authorization-token API: an application that calls ECR directly, including `GetAuthorizationToken`, needs a separate integration.

![Before: on AWS your build pushes images to Amazon ECR and your workloads pull from it. After: on the target cloud the same docker push and pull reach in-cluster registry, provisioned at the build. Only the registry address is rewritten; the image is unchanged and Tensor9 is not in the pull path.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMTg0IiB2aWV3Qm94PSIwIDAgODM2IDE4NCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJCZWZvcmU6IG9uIEFXUyB5b3VyIGJ1aWxkIHB1c2hlcyBpbWFnZXMgdG8gQW1hem9uIEVDUiBhbmQgeW91ciB3b3JrbG9hZHMgcHVsbCBmcm9tIGl0LiBBZnRlcjogb24gdGhlIHRhcmdldCBjbG91ZCB0aGUgc2FtZSBkb2NrZXIgcHVzaCBhbmQgcHVsbCByZWFjaCBpbi1jbHVzdGVyIHJlZ2lzdHJ5LCBwcm92aXNpb25lZCBhdCB0aGUgYnVpbGQuIE9ubHkgdGhlIHJlZ2lzdHJ5IGFkZHJlc3MgaXMgcmV3cml0dGVuOyB0aGUgaW1hZ2UgaXMgdW5jaGFuZ2VkIGFuZCBUZW5zb3I5IGlzIG5vdCBpbiB0aGUgcHVsbCBwYXRoLiI+PHN0eWxlPnRleHR7Zm9udC1mYW1pbHk6SW50ZXIsLWFwcGxlLXN5c3RlbSxCbGlua01hY1N5c3RlbUZvbnQsJ1NlZ29lIFVJJyxSb2JvdG8sJ0hlbHZldGljYSBOZXVlJyxBcmlhbCxzYW5zLXNlcmlmO2ZpbGw6IzMzNDE1NX08L3N0eWxlPgo8ZGVmcz48bWFya2VyIGlkPSJlY3Jody1pbmNsdXN0ZXIiIHZpZXdCb3g9IjAgMCAxMCAxMCIgcmVmWD0iOCIgcmVmWT0iNSIgbWFya2VyV2lkdGg9IjciIG1hcmtlckhlaWdodD0iNyIgb3JpZW50PSJhdXRvLXN0YXJ0LXJldmVyc2UiPjxwYXRoIGQ9Ik0wLDAgTDEwLDUgTDAsMTAgeiIgc3R5bGU9ImZpbGw6Izk0YTNiOCIvPjwvbWFya2VyPjwvZGVmcz4KPHJlY3QgeD0iMTYiIHk9IjQwIiB3aWR0aD0iMzU4IiBoZWlnaHQ9IjEyMCIgcng9IjE0IiBzdHJva2Utd2lkdGg9IjEuNCIgc3Ryb2tlLWRhc2hhcnJheT0iNSA1IiBzdHlsZT0iZmlsbDojZjhmYWZjO3N0cm9rZTojY2JkNWUxIi8+Cjx0ZXh0IHg9IjMwIiB5PSI2MCIgc3R5bGU9ImZvbnQ6IDcwMCAxMHB4IEludGVyLCBzYW5zLXNlcmlmOyBsZXR0ZXItc3BhY2luZzogMS4zcHg7IGZpbGw6ICM5NGEzYjg7IGZpbGw6IzY0NzQ4YiI+T04gQVdTIFRPREFZPC90ZXh0Pgo8cmVjdCB4PSIzMCIgeT0iNzgiIHdpZHRoPSIxMTgiIGhlaWdodD0iNjAiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0eWxlPSJmaWxsOiNmZmZmZmY7c3Ryb2tlOiNjYmQ1ZTEiLz4KPHRleHQgeD0iODkiIHk9IjEwNCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwZjE3MmE7IGZvbnQtc2l6ZToxMnB4Ij5idWlsZCAvIHBvZHM8L3RleHQ+Cjx0ZXh0IHg9Ijg5IiB5PSIxMjIiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiIj5kb2NrZXIgcHVzaCAvIHB1bGw8L3RleHQ+CjxsaW5lIHgxPSIxNDgiIHkxPSIxMDgiIHgyPSIyMDYiIHkyPSIxMDgiIHN0cm9rZS13aWR0aD0iMiIgbWFya2VyLWVuZD0idXJsKCNlY3Jody1pbmNsdXN0ZXIpIiBzdHlsZT0ic3Ryb2tlOiM5NGEzYjgiLz4KPHJlY3QgeD0iMjEwIiB5PSI3OCIgd2lkdGg9IjE1MCIgaGVpZ2h0PSI2MCIgcng9IjExIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6I2ZmZmZmZjtzdHJva2U6I2NiZDVlMSIvPgo8dGV4dCB4PSIyODUiIHk9IjEwNCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwZjE3MmE7IGZvbnQtc2l6ZToxMnB4Ij5BbWF6b24gRUNSPC90ZXh0Pgo8dGV4dCB4PSIyODUiIHk9IjEyMiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGIiPkFXUy1tYW5hZ2VkPC90ZXh0Pgo8dGV4dCB4PSI0MTgiIHk9IjMwIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTAuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMDQ3ODU3OyBmb250LXdlaWdodDo3MDAiPnNldCB1cCBhdCB0aGUgYnVpbGQ8L3RleHQ+CjxyZWN0IHg9IjQ2MiIgeT0iNDAiIHdpZHRoPSIzNjIiIGhlaWdodD0iMTIwIiByeD0iMTQiIHN0cm9rZS13aWR0aD0iMS40IiBzdHJva2UtZGFzaGFycmF5PSI1IDUiIHN0eWxlPSJmaWxsOiNmOGZhZmM7c3Ryb2tlOiNjYmQ1ZTEiLz4KPHRleHQgeD0iNDc2IiB5PSI2MCIgc3R5bGU9ImZvbnQ6IDcwMCAxMHB4IEludGVyLCBzYW5zLXNlcmlmOyBsZXR0ZXItc3BhY2luZzogMS4zcHg7IGZpbGw6ICM5NGEzYjg7IGZpbGw6IzA0Nzg1NyI+SU4gS1VCRVJORVRFUyBDTFVTVEVSPC90ZXh0Pgo8cmVjdCB4PSI0NzYiIHk9Ijc4IiB3aWR0aD0iMTA0IiBoZWlnaHQ9IjYwIiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojZmZmZmZmO3N0cm9rZTojY2JkNWUxIi8+Cjx0ZXh0IHg9IjUyOCIgeT0iMTA0IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzBmMTcyYTsgZm9udC1zaXplOjEycHgiPmJ1aWxkIC8gcG9kczwvdGV4dD4KPHRleHQgeD0iNTI4IiB5PSIxMjIiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2MDAgMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzA0Nzg1NyI+c2FtZSBjb21tYW5kczwvdGV4dD4KPGxpbmUgeDE9IjU4MCIgeTE9IjEwOCIgeDI9IjYxNiIgeTI9IjEwOCIgc3Ryb2tlLXdpZHRoPSIyIiBtYXJrZXItZW5kPSJ1cmwoI2Vjcmh3LWluY2x1c3RlcikiIHN0eWxlPSJzdHJva2U6Izk0YTNiOCIvPgo8cmVjdCB4PSI2MjAiIHk9Ijc0IiB3aWR0aD0iMTg4IiBoZWlnaHQ9IjY4IiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS43IiBzdHlsZT0iZmlsbDojZWNmZGY1O3N0cm9rZTojMDQ3ODU3Ii8+Cjx0ZXh0IHg9IjcxNCIgeT0iOTkiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA3MDAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMDQ3ODU3OyBmb250LXNpemU6MTEuNXB4Ij5pbi1jbHVzdGVyIHJlZ2lzdHJ5PC90ZXh0Pgo8dGV4dCB4PSI3MTQiIHk9IjExNSIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICM2NDc0OGIiPnJlZ2lzdHJ5LiZsdDtucyZndDsuc3ZjPC90ZXh0Pgo8dGV4dCB4PSI3MTQiIHk9IjEzMSIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzA0Nzg1NyI+eW91IG9wZXJhdGUgaXQsIGluLWNsdXN0ZXI8L3RleHQ+Cjx0ZXh0IHg9IjY0MyIgeT0iMTc2IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTAuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMDQ3ODU3OyBmb250LXdlaWdodDo3MDAiPlRlbnNvcjkgaXMgbm90IGluIHRoZSBwdWxsIHBhdGg8L3RleHQ+Cjwvc3ZnPg==)

![Before: on AWS your build pushes images to Amazon ECR and your workloads pull from it. After: on the target cloud the same docker push and pull reach in-cluster registry, provisioned at the build. Only the registry address is rewritten; the image is unchanged and Tensor9 is not in the pull path.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMTg0IiB2aWV3Qm94PSIwIDAgODM2IDE4NCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJCZWZvcmU6IG9uIEFXUyB5b3VyIGJ1aWxkIHB1c2hlcyBpbWFnZXMgdG8gQW1hem9uIEVDUiBhbmQgeW91ciB3b3JrbG9hZHMgcHVsbCBmcm9tIGl0LiBBZnRlcjogb24gdGhlIHRhcmdldCBjbG91ZCB0aGUgc2FtZSBkb2NrZXIgcHVzaCBhbmQgcHVsbCByZWFjaCBpbi1jbHVzdGVyIHJlZ2lzdHJ5LCBwcm92aXNpb25lZCBhdCB0aGUgYnVpbGQuIE9ubHkgdGhlIHJlZ2lzdHJ5IGFkZHJlc3MgaXMgcmV3cml0dGVuOyB0aGUgaW1hZ2UgaXMgdW5jaGFuZ2VkIGFuZCBUZW5zb3I5IGlzIG5vdCBpbiB0aGUgcHVsbCBwYXRoLiI+PHN0eWxlPnRleHR7Zm9udC1mYW1pbHk6SW50ZXIsLWFwcGxlLXN5c3RlbSxCbGlua01hY1N5c3RlbUZvbnQsJ1NlZ29lIFVJJyxSb2JvdG8sJ0hlbHZldGljYSBOZXVlJyxBcmlhbCxzYW5zLXNlcmlmO2ZpbGw6I2NiZDVlMX08L3N0eWxlPgo8ZGVmcz48bWFya2VyIGlkPSJlY3Jody1pbmNsdXN0ZXIiIHZpZXdCb3g9IjAgMCAxMCAxMCIgcmVmWD0iOCIgcmVmWT0iNSIgbWFya2VyV2lkdGg9IjciIG1hcmtlckhlaWdodD0iNyIgb3JpZW50PSJhdXRvLXN0YXJ0LXJldmVyc2UiPjxwYXRoIGQ9Ik0wLDAgTDEwLDUgTDAsMTAgeiIgc3R5bGU9ImZpbGw6IzY0NzQ4YiIvPjwvbWFya2VyPjwvZGVmcz4KPHJlY3QgeD0iMTYiIHk9IjQwIiB3aWR0aD0iMzU4IiBoZWlnaHQ9IjEyMCIgcng9IjE0IiBzdHJva2Utd2lkdGg9IjEuNCIgc3Ryb2tlLWRhc2hhcnJheT0iNSA1IiBzdHlsZT0iZmlsbDojMGYxNzJhO3N0cm9rZTojNDc1NTY5Ii8+Cjx0ZXh0IHg9IjMwIiB5PSI2MCIgc3R5bGU9ImZvbnQ6IDcwMCAxMHB4IEludGVyLCBzYW5zLXNlcmlmOyBsZXR0ZXItc3BhY2luZzogMS4zcHg7IGZpbGw6ICM2NDc0OGI7IGZpbGw6Izk0YTNiOCI+T04gQVdTIFRPREFZPC90ZXh0Pgo8cmVjdCB4PSIzMCIgeT0iNzgiIHdpZHRoPSIxMTgiIGhlaWdodD0iNjAiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0eWxlPSJmaWxsOiMxZTI5M2I7c3Ryb2tlOiM0NzU1NjkiLz4KPHRleHQgeD0iODkiIHk9IjEwNCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICNmMWY1Zjk7IGZvbnQtc2l6ZToxMnB4Ij5idWlsZCAvIHBvZHM8L3RleHQ+Cjx0ZXh0IHg9Ijg5IiB5PSIxMjIiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4Ij5kb2NrZXIgcHVzaCAvIHB1bGw8L3RleHQ+CjxsaW5lIHgxPSIxNDgiIHkxPSIxMDgiIHgyPSIyMDYiIHkyPSIxMDgiIHN0cm9rZS13aWR0aD0iMiIgbWFya2VyLWVuZD0idXJsKCNlY3Jody1pbmNsdXN0ZXIpIiBzdHlsZT0ic3Ryb2tlOiM2NDc0OGIiLz4KPHJlY3QgeD0iMjEwIiB5PSI3OCIgd2lkdGg9IjE1MCIgaGVpZ2h0PSI2MCIgcng9IjExIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6IzFlMjkzYjtzdHJva2U6IzQ3NTU2OSIvPgo8dGV4dCB4PSIyODUiIHk9IjEwNCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICNmMWY1Zjk7IGZvbnQtc2l6ZToxMnB4Ij5BbWF6b24gRUNSPC90ZXh0Pgo8dGV4dCB4PSIyODUiIHk9IjEyMiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjgiPkFXUy1tYW5hZ2VkPC90ZXh0Pgo8dGV4dCB4PSI0MTgiIHk9IjMwIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTAuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNmVlN2I3OyBmb250LXdlaWdodDo3MDAiPnNldCB1cCBhdCB0aGUgYnVpbGQ8L3RleHQ+CjxyZWN0IHg9IjQ2MiIgeT0iNDAiIHdpZHRoPSIzNjIiIGhlaWdodD0iMTIwIiByeD0iMTQiIHN0cm9rZS13aWR0aD0iMS40IiBzdHJva2UtZGFzaGFycmF5PSI1IDUiIHN0eWxlPSJmaWxsOiMwZjE3MmE7c3Ryb2tlOiM0NzU1NjkiLz4KPHRleHQgeD0iNDc2IiB5PSI2MCIgc3R5bGU9ImZvbnQ6IDcwMCAxMHB4IEludGVyLCBzYW5zLXNlcmlmOyBsZXR0ZXItc3BhY2luZzogMS4zcHg7IGZpbGw6ICM2NDc0OGI7IGZpbGw6IzZlZTdiNyI+SU4gS1VCRVJORVRFUyBDTFVTVEVSPC90ZXh0Pgo8cmVjdCB4PSI0NzYiIHk9Ijc4IiB3aWR0aD0iMTA0IiBoZWlnaHQ9IjYwIiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojMWUyOTNiO3N0cm9rZTojNDc1NTY5Ii8+Cjx0ZXh0IHg9IjUyOCIgeT0iMTA0IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogI2YxZjVmOTsgZm9udC1zaXplOjEycHgiPmJ1aWxkIC8gcG9kczwvdGV4dD4KPHRleHQgeD0iNTI4IiB5PSIxMjIiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2MDAgMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzZlZTdiNyI+c2FtZSBjb21tYW5kczwvdGV4dD4KPGxpbmUgeDE9IjU4MCIgeTE9IjEwOCIgeDI9IjYxNiIgeTI9IjEwOCIgc3Ryb2tlLXdpZHRoPSIyIiBtYXJrZXItZW5kPSJ1cmwoI2Vjcmh3LWluY2x1c3RlcikiIHN0eWxlPSJzdHJva2U6IzY0NzQ4YiIvPgo8cmVjdCB4PSI2MjAiIHk9Ijc0IiB3aWR0aD0iMTg4IiBoZWlnaHQ9IjY4IiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS43IiBzdHlsZT0iZmlsbDojMDY0ZTNiO3N0cm9rZTojNmVlN2I3Ii8+Cjx0ZXh0IHg9IjcxNCIgeT0iOTkiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA3MDAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNmVlN2I3OyBmb250LXNpemU6MTEuNXB4Ij5pbi1jbHVzdGVyIHJlZ2lzdHJ5PC90ZXh0Pgo8dGV4dCB4PSI3MTQiIHk9IjExNSIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICM5NGEzYjgiPnJlZ2lzdHJ5LiZsdDtucyZndDsuc3ZjPC90ZXh0Pgo8dGV4dCB4PSI3MTQiIHk9IjEzMSIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzZlZTdiNyI+eW91IG9wZXJhdGUgaXQsIGluLWNsdXN0ZXI8L3RleHQ+Cjx0ZXh0IHg9IjY0MyIgeT0iMTc2IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTAuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNmVlN2I3OyBmb250LXdlaWdodDo3MDAiPlRlbnNvcjkgaXMgbm90IGluIHRoZSBwdWxsIHBhdGg8L3RleHQ+Cjwvc3ZnPg==)

Your images are loaded into an in-cluster registry through the Cloud Adapter deployment at the build; afterward your workloads pull from it directly and the image is unchanged.

#### Registry features and operation

You operate the registry and configure the features of the software you choose. The registry is deployed empty : your images are loaded into it through the Cloud Adapter deployment's image delivery service before any workload pulls, and there is deliberately **no pull-through cache** back to ECR, which removes the outbound AWS dependency entirely.

**Harbor**, the recommended registry, ships built-in Trivy scan-on-push, robot accounts, per-repository retention, and immutable-tag rules, the closest match to ECR's registry-management features. **Zot** is lightweight and OCI-native, with vulnerability (CVE) search available through an optional extension. **Distribution** is the bare reference registry: it stores and delivers images and can garbage-collect unused layers, but has no scanning or tag controls. Whichever you run, your ECR repositories map one-to-one to the registry's repositories, and a workload pulls with an injected `imagePullSecret`; Harbor's robot accounts provide the richer, scoped path.

![In-cluster registry model](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjE2IiB2aWV3Qm94PSIwIDAgODM2IDIxNiIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJJbi1jbHVzdGVyIHJlZ2lzdHJ5IG1vZGVsIj48c3R5bGU+dGV4dHtmb250LWZhbWlseTpJbnRlciwtYXBwbGUtc3lzdGVtLEJsaW5rTWFjU3lzdGVtRm9udCwnU2Vnb2UgVUknLFJvYm90bywnSGVsdmV0aWNhIE5ldWUnLEFyaWFsLHNhbnMtc2VyaWY7ZmlsbDojMzM0MTU1fTwvc3R5bGU+Cjx0ZXh0IHg9IjIwIiB5PSIyNiIgc3R5bGU9ImZvbnQ6IDcwMCAxMHB4IEludGVyLCBzYW5zLXNlcmlmOyBsZXR0ZXItc3BhY2luZzogMS4zcHg7IGZpbGw6ICM5NGEzYjg7IGZpbGw6IzA0Nzg1NyI+SW4tY2x1c3RlciByZWdpc3RyeSBtb2RlbDwvdGV4dD4KPHJlY3QgeD0iMjAiIHk9IjQ0IiB3aWR0aD0iMjU2IiBoZWlnaHQ9IjY2IiByeD0iMTAiIHN0cm9rZS13aWR0aD0iMS40IiBzdHlsZT0iZmlsbDojZWNmZGY1O3N0cm9rZTojYTdmM2QwIi8+PHRleHQgeD0iMzYiIHk9IjcxIiBzdHlsZT0iZm9udDogNzAwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzA0Nzg1NzsgZm9udC1zaXplOjEycHgiPlNlbGYtbWFuYWdlZDwvdGV4dD48dGV4dCB4PSIzNiIgeT0iOTEiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiIj55b3Ugb3BlcmF0ZSB0aGUgcmVnaXN0cnk8L3RleHQ+PHJlY3QgeD0iMjk2IiB5PSI0NCIgd2lkdGg9IjI1NiIgaGVpZ2h0PSI2NiIgcng9IjEwIiBzdHJva2Utd2lkdGg9IjEuNCIgc3R5bGU9ImZpbGw6I2VjZmRmNTtzdHJva2U6I2E3ZjNkMCIvPjx0ZXh0IHg9IjMxMiIgeT0iNzEiIHN0eWxlPSJmb250OiA3MDAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMDQ3ODU3OyBmb250LXNpemU6MTJweCI+RGVwbG95ZWQgZW1wdHk8L3RleHQ+PHRleHQgeD0iMzEyIiB5PSI5MSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGIiPmltYWdlcyBsb2FkZWQgdmlhIHRoZSBhcHBsaWFuY2U8L3RleHQ+PHJlY3QgeD0iNTcyIiB5PSI0NCIgd2lkdGg9IjI1NiIgaGVpZ2h0PSI2NiIgcng9IjEwIiBzdHJva2Utd2lkdGg9IjEuNCIgc3R5bGU9ImZpbGw6I2VjZmRmNTtzdHJva2U6I2E3ZjNkMCIvPjx0ZXh0IHg9IjU4OCIgeT0iNzEiIHN0eWxlPSJmb250OiA3MDAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMDQ3ODU3OyBmb250LXNpemU6MTJweCI+SGFyYm9yIMK3IHJlY29tbWVuZGVkPC90ZXh0Pjx0ZXh0IHg9IjU4OCIgeT0iOTEiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiIj5Ucml2eSBzY2FuIMK3IHJvYm90IGFjY291bnRzPC90ZXh0PjxyZWN0IHg9IjIwIiB5PSIxMjgiIHdpZHRoPSIyNTYiIGhlaWdodD0iNjYiIHJ4PSIxMCIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0eWxlPSJmaWxsOiNlY2ZkZjU7c3Ryb2tlOiNhN2YzZDAiLz48dGV4dCB4PSIzNiIgeT0iMTU1IiBzdHlsZT0iZm9udDogNzAwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzA0Nzg1NzsgZm9udC1zaXplOjEycHgiPlpvdDwvdGV4dD48dGV4dCB4PSIzNiIgeT0iMTc1IiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YiI+bGlnaHR3ZWlnaHQsIE9DSS1uYXRpdmU8L3RleHQ+PHJlY3QgeD0iMjk2IiB5PSIxMjgiIHdpZHRoPSIyNTYiIGhlaWdodD0iNjYiIHJ4PSIxMCIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0eWxlPSJmaWxsOiNlY2ZkZjU7c3Ryb2tlOiNhN2YzZDAiLz48dGV4dCB4PSIzMTIiIHk9IjE1NSIgc3R5bGU9ImZvbnQ6IDcwMCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwNDc4NTc7IGZvbnQtc2l6ZToxMnB4Ij5EaXN0cmlidXRpb248L3RleHQ+PHRleHQgeD0iMzEyIiB5PSIxNzUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiIj5iYXJlIHJlZ2lzdHJ5LCBsYXllciBjbGVhbnVwPC90ZXh0PjxyZWN0IHg9IjU3MiIgeT0iMTI4IiB3aWR0aD0iMjU2IiBoZWlnaHQ9IjY2IiByeD0iMTAiIHN0cm9rZS13aWR0aD0iMS40IiBzdHlsZT0iZmlsbDojZWNmZGY1O3N0cm9rZTojYTdmM2QwIi8+PHRleHQgeD0iNTg4IiB5PSIxNTUiIHN0eWxlPSJmb250OiA3MDAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMDQ3ODU3OyBmb250LXNpemU6MTJweCI+UHVsbCBpZGVudGl0eTwvdGV4dD48dGV4dCB4PSI1ODgiIHk9IjE3NSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGIiPmltYWdlUHVsbFNlY3JldCAvIHJvYm90IGFjY291bnRzPC90ZXh0Pgo8L3N2Zz4=)

![In-cluster registry model](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjE2IiB2aWV3Qm94PSIwIDAgODM2IDIxNiIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJJbi1jbHVzdGVyIHJlZ2lzdHJ5IG1vZGVsIj48c3R5bGU+dGV4dHtmb250LWZhbWlseTpJbnRlciwtYXBwbGUtc3lzdGVtLEJsaW5rTWFjU3lzdGVtRm9udCwnU2Vnb2UgVUknLFJvYm90bywnSGVsdmV0aWNhIE5ldWUnLEFyaWFsLHNhbnMtc2VyaWY7ZmlsbDojY2JkNWUxfTwvc3R5bGU+Cjx0ZXh0IHg9IjIwIiB5PSIyNiIgc3R5bGU9ImZvbnQ6IDcwMCAxMHB4IEludGVyLCBzYW5zLXNlcmlmOyBsZXR0ZXItc3BhY2luZzogMS4zcHg7IGZpbGw6ICM2NDc0OGI7IGZpbGw6IzZlZTdiNyI+SW4tY2x1c3RlciByZWdpc3RyeSBtb2RlbDwvdGV4dD4KPHJlY3QgeD0iMjAiIHk9IjQ0IiB3aWR0aD0iMjU2IiBoZWlnaHQ9IjY2IiByeD0iMTAiIHN0cm9rZS13aWR0aD0iMS40IiBzdHlsZT0iZmlsbDojMDY0ZTNiO3N0cm9rZTojMDQ3ODU3Ii8+PHRleHQgeD0iMzYiIHk9IjcxIiBzdHlsZT0iZm9udDogNzAwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzZlZTdiNzsgZm9udC1zaXplOjEycHgiPlNlbGYtbWFuYWdlZDwvdGV4dD48dGV4dCB4PSIzNiIgeT0iOTEiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4Ij55b3Ugb3BlcmF0ZSB0aGUgcmVnaXN0cnk8L3RleHQ+PHJlY3QgeD0iMjk2IiB5PSI0NCIgd2lkdGg9IjI1NiIgaGVpZ2h0PSI2NiIgcng9IjEwIiBzdHJva2Utd2lkdGg9IjEuNCIgc3R5bGU9ImZpbGw6IzA2NGUzYjtzdHJva2U6IzA0Nzg1NyIvPjx0ZXh0IHg9IjMxMiIgeT0iNzEiIHN0eWxlPSJmb250OiA3MDAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNmVlN2I3OyBmb250LXNpemU6MTJweCI+RGVwbG95ZWQgZW1wdHk8L3RleHQ+PHRleHQgeD0iMzEyIiB5PSI5MSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjgiPmltYWdlcyBsb2FkZWQgdmlhIHRoZSBhcHBsaWFuY2U8L3RleHQ+PHJlY3QgeD0iNTcyIiB5PSI0NCIgd2lkdGg9IjI1NiIgaGVpZ2h0PSI2NiIgcng9IjEwIiBzdHJva2Utd2lkdGg9IjEuNCIgc3R5bGU9ImZpbGw6IzA2NGUzYjtzdHJva2U6IzA0Nzg1NyIvPjx0ZXh0IHg9IjU4OCIgeT0iNzEiIHN0eWxlPSJmb250OiA3MDAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNmVlN2I3OyBmb250LXNpemU6MTJweCI+SGFyYm9yIMK3IHJlY29tbWVuZGVkPC90ZXh0Pjx0ZXh0IHg9IjU4OCIgeT0iOTEiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4Ij5Ucml2eSBzY2FuIMK3IHJvYm90IGFjY291bnRzPC90ZXh0PjxyZWN0IHg9IjIwIiB5PSIxMjgiIHdpZHRoPSIyNTYiIGhlaWdodD0iNjYiIHJ4PSIxMCIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0eWxlPSJmaWxsOiMwNjRlM2I7c3Ryb2tlOiMwNDc4NTciLz48dGV4dCB4PSIzNiIgeT0iMTU1IiBzdHlsZT0iZm9udDogNzAwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzZlZTdiNzsgZm9udC1zaXplOjEycHgiPlpvdDwvdGV4dD48dGV4dCB4PSIzNiIgeT0iMTc1IiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiOCI+bGlnaHR3ZWlnaHQsIE9DSS1uYXRpdmU8L3RleHQ+PHJlY3QgeD0iMjk2IiB5PSIxMjgiIHdpZHRoPSIyNTYiIGhlaWdodD0iNjYiIHJ4PSIxMCIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0eWxlPSJmaWxsOiMwNjRlM2I7c3Ryb2tlOiMwNDc4NTciLz48dGV4dCB4PSIzMTIiIHk9IjE1NSIgc3R5bGU9ImZvbnQ6IDcwMCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2ZWU3Yjc7IGZvbnQtc2l6ZToxMnB4Ij5EaXN0cmlidXRpb248L3RleHQ+PHRleHQgeD0iMzEyIiB5PSIxNzUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4Ij5iYXJlIHJlZ2lzdHJ5LCBsYXllciBjbGVhbnVwPC90ZXh0PjxyZWN0IHg9IjU3MiIgeT0iMTI4IiB3aWR0aD0iMjU2IiBoZWlnaHQ9IjY2IiByeD0iMTAiIHN0cm9rZS13aWR0aD0iMS40IiBzdHlsZT0iZmlsbDojMDY0ZTNiO3N0cm9rZTojMDQ3ODU3Ii8+PHRleHQgeD0iNTg4IiB5PSIxNTUiIHN0eWxlPSJmb250OiA3MDAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNmVlN2I3OyBmb250LXNpemU6MTJweCI+UHVsbCBpZGVudGl0eTwvdGV4dD48dGV4dCB4PSI1ODgiIHk9IjE3NSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjgiPmltYWdlUHVsbFNlY3JldCAvIHJvYm90IGFjY291bnRzPC90ZXh0Pgo8L3N2Zz4=)

Choose the registry features your application needs: Harbor, Zot, or Distribution.

#### Limitations

Where ECR and an in-cluster registry stay different

* **Pulling through to ECR is not supported.** The registry starts empty. Your images are loaded through the Cloud Adapter deployment before any workload pulls; there is deliberately no pull-through cache back to ECR.
* **Scanning, immutability and retention behave differently: they depend on the registry you run.** Harbor supports most ECR management features, Zot some of them, and Distribution, a bare registry, none of them built in.
* **Cross-region replication is not supported.** An in-cluster registry is for the cluster it runs in. Images are loaded through the Cloud Adapter deployment, not replicated across regions.

#### Other considerations

Plan image delivery, credentials, and storage costs for the target registry.

* **Images are loaded through the Cloud Adapter deployment, then pulled locally.** The registry is deployed empty and your images are loaded through the Cloud Adapter deployment before any workload pulls. There is no pull-through cache back to ECR, so the running cluster does not depend on AWS.
* **You operate the registry.** There is no cloud service behind it. Harbor, Zot or Distribution is yours to run, and its availability, upgrades and access model are your responsibility.
* **Back up the registry's persistent volume.** The registry's image layers live on a PersistentVolume in the cluster, so backup and retention of the image store are yours.
* **Budget for cluster compute and storage.** The registry uses the cluster's own compute and storage rather than a managed per-tier or per-byte charge. Scanning, immutability and retention depend on which registry you chose.

## On Azure

### Container Registry (ACR)

| Operation | Area | Support | Depth | Notes |
| - | - | - | - | - |
| Registry authentication | Auth | Supported | Common | the AcrPull managed identity takes over; the registry admin user is disabled |
| docker push / pull | Image path | Supported | Common | byte-identical OCI Distribution v2; the host changes to \<registry>.azurecr.io |
| Image tag policy mapping | Immutability | Partial | Most usage | ACR image and repository write locks differ from ECR tag immutability; configure the required locks explicitly |
| Lifecycle policy mapping | Lifecycle | Partial | Most usage | registry-wide retention (Premium); a scope change from per-repo, surfaced at the build |
| Replication config | Replication | Partial | Full surface | Azure geo-replication (Premium-only); not emitted on the Standard default |
| Repository provisioning | Repositories | Supported | Common | Provisions one ACR registry with a distinct path for each ECR repository. The registry name must be globally unique, alphanumeric, and 5-50 characters. |
| Scan-on-push findings | Scanning | Partial | Most usage | scanning moves to Microsoft Defender for Containers |

#### How it works

On AWS your build pushes container images to **Amazon ECR** and your workloads pull from it. **Azure Container Registry** is Microsoft's managed OCI registry, with a tiered service model (Basic, Standard, Premium), Microsoft Entra identity, and, on Premium, geo-replication, content trust, and private networking. At the build, Tensor9 reads your ECR repositories and provisions an Azure Container Registry to match; afterward your own `docker push` and `docker pull` reach it directly, without routing image traffic through Tensor9.

The image itself never changes. ECR and Azure Container Registry both speak the **OCI Distribution v2** protocol, so your image manifest, its layer blobs, and their content digests are byte-identical on both sides; docker and containerd are untouched. The target reference uses `<registry>.azurecr.io` and the mapped repository path.

This mapping provisions a target registry and updates image references. Docker and containerd use the target registry's own protocol and credentials. It does not provide the AWS ECR management or authorization-token API: an application that calls ECR directly, including `GetAuthorizationToken`, needs a separate integration.

![Before: on AWS your build pushes images to Amazon ECR and your workloads pull from it. After: on the target cloud the same docker push and pull reach Azure Container Registry, provisioned at the build. Only the registry address is rewritten; the image is unchanged and Tensor9 is not in the pull path.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMTg0IiB2aWV3Qm94PSIwIDAgODM2IDE4NCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJCZWZvcmU6IG9uIEFXUyB5b3VyIGJ1aWxkIHB1c2hlcyBpbWFnZXMgdG8gQW1hem9uIEVDUiBhbmQgeW91ciB3b3JrbG9hZHMgcHVsbCBmcm9tIGl0LiBBZnRlcjogb24gdGhlIHRhcmdldCBjbG91ZCB0aGUgc2FtZSBkb2NrZXIgcHVzaCBhbmQgcHVsbCByZWFjaCBBenVyZSBDb250YWluZXIgUmVnaXN0cnksIHByb3Zpc2lvbmVkIGF0IHRoZSBidWlsZC4gT25seSB0aGUgcmVnaXN0cnkgYWRkcmVzcyBpcyByZXdyaXR0ZW47IHRoZSBpbWFnZSBpcyB1bmNoYW5nZWQgYW5kIFRlbnNvcjkgaXMgbm90IGluIHRoZSBwdWxsIHBhdGguIj48c3R5bGU+dGV4dHtmb250LWZhbWlseTpJbnRlciwtYXBwbGUtc3lzdGVtLEJsaW5rTWFjU3lzdGVtRm9udCwnU2Vnb2UgVUknLFJvYm90bywnSGVsdmV0aWNhIE5ldWUnLEFyaWFsLHNhbnMtc2VyaWY7ZmlsbDojMzM0MTU1fTwvc3R5bGU+CjxkZWZzPjxtYXJrZXIgaWQ9ImVjcmh3LWFjciIgdmlld0JveD0iMCAwIDEwIDEwIiByZWZYPSI4IiByZWZZPSI1IiBtYXJrZXJXaWR0aD0iNyIgbWFya2VySGVpZ2h0PSI3IiBvcmllbnQ9ImF1dG8tc3RhcnQtcmV2ZXJzZSI+PHBhdGggZD0iTTAsMCBMMTAsNSBMMCwxMCB6IiBzdHlsZT0iZmlsbDojOTRhM2I4Ii8+PC9tYXJrZXI+PC9kZWZzPgo8cmVjdCB4PSIxNiIgeT0iNDAiIHdpZHRoPSIzNTgiIGhlaWdodD0iMTIwIiByeD0iMTQiIHN0cm9rZS13aWR0aD0iMS40IiBzdHJva2UtZGFzaGFycmF5PSI1IDUiIHN0eWxlPSJmaWxsOiNmOGZhZmM7c3Ryb2tlOiNjYmQ1ZTEiLz4KPHRleHQgeD0iMzAiIHk9IjYwIiBzdHlsZT0iZm9udDogNzAwIDEwcHggSW50ZXIsIHNhbnMtc2VyaWY7IGxldHRlci1zcGFjaW5nOiAxLjNweDsgZmlsbDogIzk0YTNiODsgZmlsbDojNjQ3NDhiIj5PTiBBV1MgVE9EQVk8L3RleHQ+CjxyZWN0IHg9IjMwIiB5PSI3OCIgd2lkdGg9IjExOCIgaGVpZ2h0PSI2MCIgcng9IjExIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6I2ZmZmZmZjtzdHJva2U6I2NiZDVlMSIvPgo8dGV4dCB4PSI4OSIgeT0iMTA0IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzBmMTcyYTsgZm9udC1zaXplOjEycHgiPmJ1aWxkIC8gcG9kczwvdGV4dD4KPHRleHQgeD0iODkiIHk9IjEyMiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGIiPmRvY2tlciBwdXNoIC8gcHVsbDwvdGV4dD4KPGxpbmUgeDE9IjE0OCIgeTE9IjEwOCIgeDI9IjIwNiIgeTI9IjEwOCIgc3Ryb2tlLXdpZHRoPSIyIiBtYXJrZXItZW5kPSJ1cmwoI2Vjcmh3LWFjcikiIHN0eWxlPSJzdHJva2U6Izk0YTNiOCIvPgo8cmVjdCB4PSIyMTAiIHk9Ijc4IiB3aWR0aD0iMTUwIiBoZWlnaHQ9IjYwIiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojZmZmZmZmO3N0cm9rZTojY2JkNWUxIi8+Cjx0ZXh0IHg9IjI4NSIgeT0iMTA0IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzBmMTcyYTsgZm9udC1zaXplOjEycHgiPkFtYXpvbiBFQ1I8L3RleHQ+Cjx0ZXh0IHg9IjI4NSIgeT0iMTIyIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YiI+QVdTLW1hbmFnZWQ8L3RleHQ+Cjx0ZXh0IHg9IjQxOCIgeT0iMzAiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMC41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwNDc4NTc7IGZvbnQtd2VpZ2h0OjcwMCI+c2V0IHVwIGF0IHRoZSBidWlsZDwvdGV4dD4KPHJlY3QgeD0iNDYyIiB5PSI0MCIgd2lkdGg9IjM2MiIgaGVpZ2h0PSIxMjAiIHJ4PSIxNCIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0cm9rZS1kYXNoYXJyYXk9IjUgNSIgc3R5bGU9ImZpbGw6I2Y4ZmFmYztzdHJva2U6I2NiZDVlMSIvPgo8dGV4dCB4PSI0NzYiIHk9IjYwIiBzdHlsZT0iZm9udDogNzAwIDEwcHggSW50ZXIsIHNhbnMtc2VyaWY7IGxldHRlci1zcGFjaW5nOiAxLjNweDsgZmlsbDogIzk0YTNiODsgZmlsbDojMDQ3ODU3Ij5PTiBBWlVSRSBTVUJTQ1JJUFRJT048L3RleHQ+CjxyZWN0IHg9IjQ3NiIgeT0iNzgiIHdpZHRoPSIxMDQiIGhlaWdodD0iNjAiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0eWxlPSJmaWxsOiNmZmZmZmY7c3Ryb2tlOiNjYmQ1ZTEiLz4KPHRleHQgeD0iNTI4IiB5PSIxMDQiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMGYxNzJhOyBmb250LXNpemU6MTJweCI+YnVpbGQgLyBwb2RzPC90ZXh0Pgo8dGV4dCB4PSI1MjgiIHk9IjEyMiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDYwMCAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMDQ3ODU3Ij5zYW1lIGNvbW1hbmRzPC90ZXh0Pgo8bGluZSB4MT0iNTgwIiB5MT0iMTA4IiB4Mj0iNjE2IiB5Mj0iMTA4IiBzdHJva2Utd2lkdGg9IjIiIG1hcmtlci1lbmQ9InVybCgjZWNyaHctYWNyKSIgc3R5bGU9InN0cm9rZTojOTRhM2I4Ii8+CjxyZWN0IHg9IjYyMCIgeT0iNzQiIHdpZHRoPSIxODgiIGhlaWdodD0iNjgiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjciIHN0eWxlPSJmaWxsOiNlY2ZkZjU7c3Ryb2tlOiMwNDc4NTciLz4KPHRleHQgeD0iNzE0IiB5PSI5OSIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDcwMCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwNDc4NTc7IGZvbnQtc2l6ZToxMS41cHgiPkF6dXJlIENvbnRhaW5lciBSZWdpc3RyeTwvdGV4dD4KPHRleHQgeD0iNzE0IiB5PSIxMTUiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMHB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjNjQ3NDhiIj4mbHQ7cmVnaXN0cnkmZ3Q7LmF6dXJlY3IuaW88L3RleHQ+Cjx0ZXh0IHg9IjcxNCIgeT0iMTMxIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTAuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMDQ3ODU3Ij50aGUgdGFyZ2V0IGNsb3VkJ3MgbmF0aXZlIHJlZ2lzdHJ5PC90ZXh0Pgo8dGV4dCB4PSI2NDMiIHk9IjE3NiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzA0Nzg1NzsgZm9udC13ZWlnaHQ6NzAwIj5UZW5zb3I5IGlzIG5vdCBpbiB0aGUgcHVsbCBwYXRoPC90ZXh0Pgo8L3N2Zz4=)

![Before: on AWS your build pushes images to Amazon ECR and your workloads pull from it. After: on the target cloud the same docker push and pull reach Azure Container Registry, provisioned at the build. Only the registry address is rewritten; the image is unchanged and Tensor9 is not in the pull path.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMTg0IiB2aWV3Qm94PSIwIDAgODM2IDE4NCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJCZWZvcmU6IG9uIEFXUyB5b3VyIGJ1aWxkIHB1c2hlcyBpbWFnZXMgdG8gQW1hem9uIEVDUiBhbmQgeW91ciB3b3JrbG9hZHMgcHVsbCBmcm9tIGl0LiBBZnRlcjogb24gdGhlIHRhcmdldCBjbG91ZCB0aGUgc2FtZSBkb2NrZXIgcHVzaCBhbmQgcHVsbCByZWFjaCBBenVyZSBDb250YWluZXIgUmVnaXN0cnksIHByb3Zpc2lvbmVkIGF0IHRoZSBidWlsZC4gT25seSB0aGUgcmVnaXN0cnkgYWRkcmVzcyBpcyByZXdyaXR0ZW47IHRoZSBpbWFnZSBpcyB1bmNoYW5nZWQgYW5kIFRlbnNvcjkgaXMgbm90IGluIHRoZSBwdWxsIHBhdGguIj48c3R5bGU+dGV4dHtmb250LWZhbWlseTpJbnRlciwtYXBwbGUtc3lzdGVtLEJsaW5rTWFjU3lzdGVtRm9udCwnU2Vnb2UgVUknLFJvYm90bywnSGVsdmV0aWNhIE5ldWUnLEFyaWFsLHNhbnMtc2VyaWY7ZmlsbDojY2JkNWUxfTwvc3R5bGU+CjxkZWZzPjxtYXJrZXIgaWQ9ImVjcmh3LWFjciIgdmlld0JveD0iMCAwIDEwIDEwIiByZWZYPSI4IiByZWZZPSI1IiBtYXJrZXJXaWR0aD0iNyIgbWFya2VySGVpZ2h0PSI3IiBvcmllbnQ9ImF1dG8tc3RhcnQtcmV2ZXJzZSI+PHBhdGggZD0iTTAsMCBMMTAsNSBMMCwxMCB6IiBzdHlsZT0iZmlsbDojNjQ3NDhiIi8+PC9tYXJrZXI+PC9kZWZzPgo8cmVjdCB4PSIxNiIgeT0iNDAiIHdpZHRoPSIzNTgiIGhlaWdodD0iMTIwIiByeD0iMTQiIHN0cm9rZS13aWR0aD0iMS40IiBzdHJva2UtZGFzaGFycmF5PSI1IDUiIHN0eWxlPSJmaWxsOiMwZjE3MmE7c3Ryb2tlOiM0NzU1NjkiLz4KPHRleHQgeD0iMzAiIHk9IjYwIiBzdHlsZT0iZm9udDogNzAwIDEwcHggSW50ZXIsIHNhbnMtc2VyaWY7IGxldHRlci1zcGFjaW5nOiAxLjNweDsgZmlsbDogIzY0NzQ4YjsgZmlsbDojOTRhM2I4Ij5PTiBBV1MgVE9EQVk8L3RleHQ+CjxyZWN0IHg9IjMwIiB5PSI3OCIgd2lkdGg9IjExOCIgaGVpZ2h0PSI2MCIgcng9IjExIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6IzFlMjkzYjtzdHJva2U6IzQ3NTU2OSIvPgo8dGV4dCB4PSI4OSIgeT0iMTA0IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogI2YxZjVmOTsgZm9udC1zaXplOjEycHgiPmJ1aWxkIC8gcG9kczwvdGV4dD4KPHRleHQgeD0iODkiIHk9IjEyMiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjgiPmRvY2tlciBwdXNoIC8gcHVsbDwvdGV4dD4KPGxpbmUgeDE9IjE0OCIgeTE9IjEwOCIgeDI9IjIwNiIgeTI9IjEwOCIgc3Ryb2tlLXdpZHRoPSIyIiBtYXJrZXItZW5kPSJ1cmwoI2Vjcmh3LWFjcikiIHN0eWxlPSJzdHJva2U6IzY0NzQ4YiIvPgo8cmVjdCB4PSIyMTAiIHk9Ijc4IiB3aWR0aD0iMTUwIiBoZWlnaHQ9IjYwIiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojMWUyOTNiO3N0cm9rZTojNDc1NTY5Ii8+Cjx0ZXh0IHg9IjI4NSIgeT0iMTA0IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogI2YxZjVmOTsgZm9udC1zaXplOjEycHgiPkFtYXpvbiBFQ1I8L3RleHQ+Cjx0ZXh0IHg9IjI4NSIgeT0iMTIyIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiOCI+QVdTLW1hbmFnZWQ8L3RleHQ+Cjx0ZXh0IHg9IjQxOCIgeT0iMzAiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMC41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2ZWU3Yjc7IGZvbnQtd2VpZ2h0OjcwMCI+c2V0IHVwIGF0IHRoZSBidWlsZDwvdGV4dD4KPHJlY3QgeD0iNDYyIiB5PSI0MCIgd2lkdGg9IjM2MiIgaGVpZ2h0PSIxMjAiIHJ4PSIxNCIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0cm9rZS1kYXNoYXJyYXk9IjUgNSIgc3R5bGU9ImZpbGw6IzBmMTcyYTtzdHJva2U6IzQ3NTU2OSIvPgo8dGV4dCB4PSI0NzYiIHk9IjYwIiBzdHlsZT0iZm9udDogNzAwIDEwcHggSW50ZXIsIHNhbnMtc2VyaWY7IGxldHRlci1zcGFjaW5nOiAxLjNweDsgZmlsbDogIzY0NzQ4YjsgZmlsbDojNmVlN2I3Ij5PTiBBWlVSRSBTVUJTQ1JJUFRJT048L3RleHQ+CjxyZWN0IHg9IjQ3NiIgeT0iNzgiIHdpZHRoPSIxMDQiIGhlaWdodD0iNjAiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0eWxlPSJmaWxsOiMxZTI5M2I7c3Ryb2tlOiM0NzU1NjkiLz4KPHRleHQgeD0iNTI4IiB5PSIxMDQiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjZjFmNWY5OyBmb250LXNpemU6MTJweCI+YnVpbGQgLyBwb2RzPC90ZXh0Pgo8dGV4dCB4PSI1MjgiIHk9IjEyMiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDYwMCAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNmVlN2I3Ij5zYW1lIGNvbW1hbmRzPC90ZXh0Pgo8bGluZSB4MT0iNTgwIiB5MT0iMTA4IiB4Mj0iNjE2IiB5Mj0iMTA4IiBzdHJva2Utd2lkdGg9IjIiIG1hcmtlci1lbmQ9InVybCgjZWNyaHctYWNyKSIgc3R5bGU9InN0cm9rZTojNjQ3NDhiIi8+CjxyZWN0IHg9IjYyMCIgeT0iNzQiIHdpZHRoPSIxODgiIGhlaWdodD0iNjgiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjciIHN0eWxlPSJmaWxsOiMwNjRlM2I7c3Ryb2tlOiM2ZWU3YjciLz4KPHRleHQgeD0iNzE0IiB5PSI5OSIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDcwMCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2ZWU3Yjc7IGZvbnQtc2l6ZToxMS41cHgiPkF6dXJlIENvbnRhaW5lciBSZWdpc3RyeTwvdGV4dD4KPHRleHQgeD0iNzE0IiB5PSIxMTUiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMHB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjOTRhM2I4Ij4mbHQ7cmVnaXN0cnkmZ3Q7LmF6dXJlY3IuaW88L3RleHQ+Cjx0ZXh0IHg9IjcxNCIgeT0iMTMxIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTAuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNmVlN2I3Ij50aGUgdGFyZ2V0IGNsb3VkJ3MgbmF0aXZlIHJlZ2lzdHJ5PC90ZXh0Pgo8dGV4dCB4PSI2NDMiIHk9IjE3NiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzZlZTdiNzsgZm9udC13ZWlnaHQ6NzAwIj5UZW5zb3I5IGlzIG5vdCBpbiB0aGUgcHVsbCBwYXRoPC90ZXh0Pgo8L3N2Zz4=)

Your ECR repositories are provisioned as an Azure Container Registry at the build; afterward your push and pull reach it directly and the image is unchanged.

#### Azure Container Registry features

Azure Container Registry offers **Basic, Standard, and Premium tiers**, which differ in storage, throughput and features. Premium adds **geo-replication**, which turns one registry into a set of regional replicas behind a single login server, so each region pulls locally; **content trust** lets you push and enforce signed images; and **ACR Tasks** build and patch images inside the registry, including automatic rebuilds when a base image changes.

For AKS image pulls, grant the [kubelet managed identity](https://learn.microsoft.com/en-us/azure/container-registry/authenticate-kubernetes-options) access to the registry. Use **AcrPull** for a registry using the conventional RBAC model, or the repository-reader role required by an ABAC-enabled registry. Other clusters can use an `imagePullSecret`. The application's workload identity is separate from the identity that pulls its image. **Private Link** keeps the registry on a private endpoint. A single Azure Container Registry holds many repositories as paths beneath one host. ECR also groups repositories within an account-and-region registry. Tensor9 provisions one ACR registry for the repository set and rewrites each image reference to its target repository path.

![Azure Container Registry features](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjE2IiB2aWV3Qm94PSIwIDAgODM2IDIxNiIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJBenVyZSBDb250YWluZXIgUmVnaXN0cnkgZmVhdHVyZXMiPjxzdHlsZT50ZXh0e2ZvbnQtZmFtaWx5OkludGVyLC1hcHBsZS1zeXN0ZW0sQmxpbmtNYWNTeXN0ZW1Gb250LCdTZWdvZSBVSScsUm9ib3RvLCdIZWx2ZXRpY2EgTmV1ZScsQXJpYWwsc2Fucy1zZXJpZjtmaWxsOiMzMzQxNTV9PC9zdHlsZT4KPHRleHQgeD0iMjAiIHk9IjI2IiBzdHlsZT0iZm9udDogNzAwIDEwcHggSW50ZXIsIHNhbnMtc2VyaWY7IGxldHRlci1zcGFjaW5nOiAxLjNweDsgZmlsbDogIzk0YTNiODsgZmlsbDojMDQ3ODU3Ij5BenVyZSBDb250YWluZXIgUmVnaXN0cnkgZmVhdHVyZXM8L3RleHQ+CjxyZWN0IHg9IjIwIiB5PSI0NCIgd2lkdGg9IjI1NiIgaGVpZ2h0PSI2NiIgcng9IjEwIiBzdHJva2Utd2lkdGg9IjEuNCIgc3R5bGU9ImZpbGw6I2VjZmRmNTtzdHJva2U6I2E3ZjNkMCIvPjx0ZXh0IHg9IjM2IiB5PSI3MSIgc3R5bGU9ImZvbnQ6IDcwMCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwNDc4NTc7IGZvbnQtc2l6ZToxMnB4Ij5TS1UgdGllcnM8L3RleHQ+PHRleHQgeD0iMzYiIHk9IjkxIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YiI+QmFzaWMgwrcgU3RhbmRhcmQgwrcgUHJlbWl1bTwvdGV4dD48cmVjdCB4PSIyOTYiIHk9IjQ0IiB3aWR0aD0iMjU2IiBoZWlnaHQ9IjY2IiByeD0iMTAiIHN0cm9rZS13aWR0aD0iMS40IiBzdHlsZT0iZmlsbDojZWNmZGY1O3N0cm9rZTojYTdmM2QwIi8+PHRleHQgeD0iMzEyIiB5PSI3MSIgc3R5bGU9ImZvbnQ6IDcwMCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwNDc4NTc7IGZvbnQtc2l6ZToxMnB4Ij5HZW8tcmVwbGljYXRpb248L3RleHQ+PHRleHQgeD0iMzEyIiB5PSI5MSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGIiPnJlZ2lvbmFsIHJlcGxpY2FzIMK3IFByZW1pdW08L3RleHQ+PHJlY3QgeD0iNTcyIiB5PSI0NCIgd2lkdGg9IjI1NiIgaGVpZ2h0PSI2NiIgcng9IjEwIiBzdHJva2Utd2lkdGg9IjEuNCIgc3R5bGU9ImZpbGw6I2VjZmRmNTtzdHJva2U6I2E3ZjNkMCIvPjx0ZXh0IHg9IjU4OCIgeT0iNzEiIHN0eWxlPSJmb250OiA3MDAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMDQ3ODU3OyBmb250LXNpemU6MTJweCI+Q29udGVudCB0cnVzdDwvdGV4dD48dGV4dCB4PSI1ODgiIHk9IjkxIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YiI+c2lnbmVkIGltYWdlcyDCtyBQcmVtaXVtPC90ZXh0PjxyZWN0IHg9IjIwIiB5PSIxMjgiIHdpZHRoPSIyNTYiIGhlaWdodD0iNjYiIHJ4PSIxMCIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0eWxlPSJmaWxsOiNlY2ZkZjU7c3Ryb2tlOiNhN2YzZDAiLz48dGV4dCB4PSIzNiIgeT0iMTU1IiBzdHlsZT0iZm9udDogNzAwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzA0Nzg1NzsgZm9udC1zaXplOjEycHgiPkFDUiBUYXNrczwvdGV4dD48dGV4dCB4PSIzNiIgeT0iMTc1IiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YiI+YnVpbGQgJmFtcDsgcGF0Y2ggaW4gdGhlIHJlZ2lzdHJ5PC90ZXh0PjxyZWN0IHg9IjI5NiIgeT0iMTI4IiB3aWR0aD0iMjU2IiBoZWlnaHQ9IjY2IiByeD0iMTAiIHN0cm9rZS13aWR0aD0iMS40IiBzdHlsZT0iZmlsbDojZWNmZGY1O3N0cm9rZTojYTdmM2QwIi8+PHRleHQgeD0iMzEyIiB5PSIxNTUiIHN0eWxlPSJmb250OiA3MDAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMDQ3ODU3OyBmb250LXNpemU6MTJweCI+UHVsbCBpZGVudGl0eTwvdGV4dD48dGV4dCB4PSIzMTIiIHk9IjE3NSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGIiPkFjclB1bGwgbWFuYWdlZCBpZGVudGl0eSwgYWRtaW4gb2ZmPC90ZXh0PjxyZWN0IHg9IjU3MiIgeT0iMTI4IiB3aWR0aD0iMjU2IiBoZWlnaHQ9IjY2IiByeD0iMTAiIHN0cm9rZS13aWR0aD0iMS40IiBzdHlsZT0iZmlsbDojZWNmZGY1O3N0cm9rZTojYTdmM2QwIi8+PHRleHQgeD0iNTg4IiB5PSIxNTUiIHN0eWxlPSJmb250OiA3MDAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMDQ3ODU3OyBmb250LXNpemU6MTJweCI+UHJpdmF0ZSBMaW5rPC90ZXh0Pjx0ZXh0IHg9IjU4OCIgeT0iMTc1IiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YiI+cHJpdmF0ZSBlbmRwb2ludHMgwrcgUHJlbWl1bTwvdGV4dD4KPC9zdmc+)

![Azure Container Registry features](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjE2IiB2aWV3Qm94PSIwIDAgODM2IDIxNiIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJBenVyZSBDb250YWluZXIgUmVnaXN0cnkgZmVhdHVyZXMiPjxzdHlsZT50ZXh0e2ZvbnQtZmFtaWx5OkludGVyLC1hcHBsZS1zeXN0ZW0sQmxpbmtNYWNTeXN0ZW1Gb250LCdTZWdvZSBVSScsUm9ib3RvLCdIZWx2ZXRpY2EgTmV1ZScsQXJpYWwsc2Fucy1zZXJpZjtmaWxsOiNjYmQ1ZTF9PC9zdHlsZT4KPHRleHQgeD0iMjAiIHk9IjI2IiBzdHlsZT0iZm9udDogNzAwIDEwcHggSW50ZXIsIHNhbnMtc2VyaWY7IGxldHRlci1zcGFjaW5nOiAxLjNweDsgZmlsbDogIzY0NzQ4YjsgZmlsbDojNmVlN2I3Ij5BenVyZSBDb250YWluZXIgUmVnaXN0cnkgZmVhdHVyZXM8L3RleHQ+CjxyZWN0IHg9IjIwIiB5PSI0NCIgd2lkdGg9IjI1NiIgaGVpZ2h0PSI2NiIgcng9IjEwIiBzdHJva2Utd2lkdGg9IjEuNCIgc3R5bGU9ImZpbGw6IzA2NGUzYjtzdHJva2U6IzA0Nzg1NyIvPjx0ZXh0IHg9IjM2IiB5PSI3MSIgc3R5bGU9ImZvbnQ6IDcwMCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2ZWU3Yjc7IGZvbnQtc2l6ZToxMnB4Ij5TS1UgdGllcnM8L3RleHQ+PHRleHQgeD0iMzYiIHk9IjkxIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiOCI+QmFzaWMgwrcgU3RhbmRhcmQgwrcgUHJlbWl1bTwvdGV4dD48cmVjdCB4PSIyOTYiIHk9IjQ0IiB3aWR0aD0iMjU2IiBoZWlnaHQ9IjY2IiByeD0iMTAiIHN0cm9rZS13aWR0aD0iMS40IiBzdHlsZT0iZmlsbDojMDY0ZTNiO3N0cm9rZTojMDQ3ODU3Ii8+PHRleHQgeD0iMzEyIiB5PSI3MSIgc3R5bGU9ImZvbnQ6IDcwMCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2ZWU3Yjc7IGZvbnQtc2l6ZToxMnB4Ij5HZW8tcmVwbGljYXRpb248L3RleHQ+PHRleHQgeD0iMzEyIiB5PSI5MSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjgiPnJlZ2lvbmFsIHJlcGxpY2FzIMK3IFByZW1pdW08L3RleHQ+PHJlY3QgeD0iNTcyIiB5PSI0NCIgd2lkdGg9IjI1NiIgaGVpZ2h0PSI2NiIgcng9IjEwIiBzdHJva2Utd2lkdGg9IjEuNCIgc3R5bGU9ImZpbGw6IzA2NGUzYjtzdHJva2U6IzA0Nzg1NyIvPjx0ZXh0IHg9IjU4OCIgeT0iNzEiIHN0eWxlPSJmb250OiA3MDAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNmVlN2I3OyBmb250LXNpemU6MTJweCI+Q29udGVudCB0cnVzdDwvdGV4dD48dGV4dCB4PSI1ODgiIHk9IjkxIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiOCI+c2lnbmVkIGltYWdlcyDCtyBQcmVtaXVtPC90ZXh0PjxyZWN0IHg9IjIwIiB5PSIxMjgiIHdpZHRoPSIyNTYiIGhlaWdodD0iNjYiIHJ4PSIxMCIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0eWxlPSJmaWxsOiMwNjRlM2I7c3Ryb2tlOiMwNDc4NTciLz48dGV4dCB4PSIzNiIgeT0iMTU1IiBzdHlsZT0iZm9udDogNzAwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzZlZTdiNzsgZm9udC1zaXplOjEycHgiPkFDUiBUYXNrczwvdGV4dD48dGV4dCB4PSIzNiIgeT0iMTc1IiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiOCI+YnVpbGQgJmFtcDsgcGF0Y2ggaW4gdGhlIHJlZ2lzdHJ5PC90ZXh0PjxyZWN0IHg9IjI5NiIgeT0iMTI4IiB3aWR0aD0iMjU2IiBoZWlnaHQ9IjY2IiByeD0iMTAiIHN0cm9rZS13aWR0aD0iMS40IiBzdHlsZT0iZmlsbDojMDY0ZTNiO3N0cm9rZTojMDQ3ODU3Ii8+PHRleHQgeD0iMzEyIiB5PSIxNTUiIHN0eWxlPSJmb250OiA3MDAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNmVlN2I3OyBmb250LXNpemU6MTJweCI+UHVsbCBpZGVudGl0eTwvdGV4dD48dGV4dCB4PSIzMTIiIHk9IjE3NSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjgiPkFjclB1bGwgbWFuYWdlZCBpZGVudGl0eSwgYWRtaW4gb2ZmPC90ZXh0PjxyZWN0IHg9IjU3MiIgeT0iMTI4IiB3aWR0aD0iMjU2IiBoZWlnaHQ9IjY2IiByeD0iMTAiIHN0cm9rZS13aWR0aD0iMS40IiBzdHlsZT0iZmlsbDojMDY0ZTNiO3N0cm9rZTojMDQ3ODU3Ii8+PHRleHQgeD0iNTg4IiB5PSIxNTUiIHN0eWxlPSJmb250OiA3MDAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNmVlN2I3OyBmb250LXNpemU6MTJweCI+UHJpdmF0ZSBMaW5rPC90ZXh0Pjx0ZXh0IHg9IjU4OCIgeT0iMTc1IiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiOCI+cHJpdmF0ZSBlbmRwb2ludHMgwrcgUHJlbWl1bTwvdGV4dD4KPC9zdmc+)

Azure Container Registry tiers, authentication, and optional features.

#### Limitations

Where ECR and Azure Container Registry stay different

* **Repository layout behaves differently: all repositories share one registry.** Tensor9 provisions one ACR registry for the ECR repository set. Repository paths stay distinct; review the rewritten image references and the shared registry settings.
* **Tag immutability and retention behave differently.** ACR can lock individual images or entire repositories against writes. These locks differ from ECR's immutable-tag setting: locking a repository also blocks new pushes. Configure the locks you need separately. Registry-wide retention requires Premium.
* **ECR enhanced scanning is not supported.** Scanning moves to Microsoft Defender for Containers, which has its own coverage and cadence.
* **Geo-replication and private networking are not supported on Basic or Standard.** Both require the Premium tier.

#### Other considerations

Plan image delivery, credentials, and storage costs for the target registry.

* **Push images from your build pipeline.** The build creates the Azure Container Registry to match your ECR repositories. Point your pipeline at `<registry>.azurecr.io` and push images there yourself; image traffic does not go through Tensor9.
* **Configure Microsoft Entra pull credentials.** A workload that pulled with its AWS IAM identity now pulls with an AcrPull managed identity (or an `imagePullSecret`). Set up that credential on Azure; it is not copied from AWS.
* **Microsoft operates the registry; you choose the tier.** Azure runs the registry and its availability. The tier you pick (Basic, Standard, Premium) sets storage, throughput and which features are available.
* **Cost depends on the selected tier.** Azure Container Registry bills per tier plus storage, and geo-replication and Private Link require Premium, so the feature set you rely on drives the tier and its cost.

## On DigitalOcean

### DigitalOcean Container Registry

#### How it works

Tensor9 maps the source ECR repositories to image paths under one DigitalOcean Container Registry. Images use `registry.digitalocean.com/<registry>/<repository>`. Docker and containerd use the target registry directly; the image layers and digests remain the same.

Provision the registry and publish the required images before starting workloads. Keep the digests needed for rollback as well as the current release. Changing an image reference does not copy an image that the target registry has never received.

#### Publishing and pull credentials

The build pipeline authenticates with DigitalOcean registry credentials to push images. For Kubernetes, configure the [DOKS integration or a registry pull secret](https://docs.digitalocean.com/products/container-registry/how-to/use-registry-docker-kubernetes/). Image pulling happens before the application starts, so an application service account's workload federation is a separate permission path.

Grant publishing access only where needed and use read access for image consumers. Test credential renewal and a pull from a fresh node; an already cached image can hide a missing registry permission.

#### Limitations

Where ECR and DigitalOcean Container Registry differ

* **Repository layout behaves differently: one registry holds every repository.** The mapping uses one registry for the source repository set. DigitalOcean's [Professional plan also supports multiple registries](https://docs.digitalocean.com/products/container-registry/details/features/), but this layout does not use that feature to recreate one registry per source repository.
* **ECR resource policies, enhanced scanning, lifecycle rules and cross-region replication behave differently.** Configure the security checks, cleanup and image copies you need in the registry's own tooling.
* **AWS ECR management APIs are not supported.** Registry login supplies push and pull credentials; it does not reproduce the AWS ECR management APIs.

#### Other considerations

**Plan and cleanup.** Choose the subscription for stored layers and repository count. Schedule cleanup of obsolete tags and digests, then run garbage collection where needed to reclaim storage. Keep images still used by running deployments and rollback plans.

**What to monitor.** DigitalOcean operates registry availability. Monitor push and pull errors, storage use and deployment startup time with your actual image sizes and release cadence.

## On Google Cloud

### Artifact Registry

| Operation | Area | Support | Depth | Notes |
| - | - | - | - | - |
| Registry authentication | Auth | Supported | Common | Native registry credentials: the GKE node service account needs Artifact Registry Reader; application workload federation is separate |
| docker push / pull | Image path | Supported | Common | byte-identical OCI Distribution v2; the host changes to \<location>-docker.pkg.dev |
| Image tag policy mapping | Immutability | Supported | Most usage | IMMUTABLE\_TAGS repository setting |
| Lifecycle policy mapping | Lifecycle | Partial | Most usage | Per-repository cleanup policies provide count or age retention for one image package. Keeping ten versions combines delete and keep rules. Tag selectors, ECR rule priority, age clocks and immutable tags require separate policy decisions; the full ECR rule language is not preserved. |
| Replication config | Replication | Out of scope | Full surface | ECR destination push replication is not mapped. Multi-region storage, pull-through caches and virtual repositories do not create the specified regional or account replicas; deliver required image copies through your pipeline. |
| Repository provisioning | Repositories | Supported | Common | one Docker-format repository (format = DOCKER) per ECR repository (N to N) |
| Scan-on-push findings | Scanning | Partial | Most usage | Container Analysis / Artifact Analysis (on-push + continuous) |

#### How it works

On AWS your build pushes container images to **Amazon ECR** and your workloads pull from it. **Google Artifact Registry** is Google Cloud's unified artifact service: one system that hosts many package formats, governs access with per-repository IAM, and integrates with VPC Service Controls and customer-managed encryption. At the build, Tensor9 reads your ECR repositories and provisions a Docker-format Artifact Registry repository for each one; afterward your own `docker push` and `docker pull` reach it directly, without routing image traffic through Tensor9.

The image itself never changes. ECR and Artifact Registry both speak the **OCI Distribution v2** protocol, so your image manifest, its layer blobs, and their content digests are byte-identical on both sides; docker and containerd are untouched. The target reference includes the `<location>-docker.pkg.dev` host, project, repository and image path.

This mapping provisions a target registry and updates image references. Docker and containerd use the target registry's own protocol and credentials. It does not provide the AWS ECR management or authorization-token API: an application that calls ECR directly, including `GetAuthorizationToken`, needs a separate integration.

![Before: on AWS your build pushes images to Amazon ECR and your workloads pull from it. After: on the target cloud the same docker push and pull reach Google Artifact Registry, provisioned at the build. Only the registry address is rewritten; the image is unchanged and Tensor9 is not in the pull path.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMTg0IiB2aWV3Qm94PSIwIDAgODM2IDE4NCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJCZWZvcmU6IG9uIEFXUyB5b3VyIGJ1aWxkIHB1c2hlcyBpbWFnZXMgdG8gQW1hem9uIEVDUiBhbmQgeW91ciB3b3JrbG9hZHMgcHVsbCBmcm9tIGl0LiBBZnRlcjogb24gdGhlIHRhcmdldCBjbG91ZCB0aGUgc2FtZSBkb2NrZXIgcHVzaCBhbmQgcHVsbCByZWFjaCBHb29nbGUgQXJ0aWZhY3QgUmVnaXN0cnksIHByb3Zpc2lvbmVkIGF0IHRoZSBidWlsZC4gT25seSB0aGUgcmVnaXN0cnkgYWRkcmVzcyBpcyByZXdyaXR0ZW47IHRoZSBpbWFnZSBpcyB1bmNoYW5nZWQgYW5kIFRlbnNvcjkgaXMgbm90IGluIHRoZSBwdWxsIHBhdGguIj48c3R5bGU+dGV4dHtmb250LWZhbWlseTpJbnRlciwtYXBwbGUtc3lzdGVtLEJsaW5rTWFjU3lzdGVtRm9udCwnU2Vnb2UgVUknLFJvYm90bywnSGVsdmV0aWNhIE5ldWUnLEFyaWFsLHNhbnMtc2VyaWY7ZmlsbDojMzM0MTU1fTwvc3R5bGU+CjxkZWZzPjxtYXJrZXIgaWQ9ImVjcmh3LWdhciIgdmlld0JveD0iMCAwIDEwIDEwIiByZWZYPSI4IiByZWZZPSI1IiBtYXJrZXJXaWR0aD0iNyIgbWFya2VySGVpZ2h0PSI3IiBvcmllbnQ9ImF1dG8tc3RhcnQtcmV2ZXJzZSI+PHBhdGggZD0iTTAsMCBMMTAsNSBMMCwxMCB6IiBzdHlsZT0iZmlsbDojOTRhM2I4Ii8+PC9tYXJrZXI+PC9kZWZzPgo8cmVjdCB4PSIxNiIgeT0iNDAiIHdpZHRoPSIzNTgiIGhlaWdodD0iMTIwIiByeD0iMTQiIHN0cm9rZS13aWR0aD0iMS40IiBzdHJva2UtZGFzaGFycmF5PSI1IDUiIHN0eWxlPSJmaWxsOiNmOGZhZmM7c3Ryb2tlOiNjYmQ1ZTEiLz4KPHRleHQgeD0iMzAiIHk9IjYwIiBzdHlsZT0iZm9udDogNzAwIDEwcHggSW50ZXIsIHNhbnMtc2VyaWY7IGxldHRlci1zcGFjaW5nOiAxLjNweDsgZmlsbDogIzk0YTNiODsgZmlsbDojNjQ3NDhiIj5PTiBBV1MgVE9EQVk8L3RleHQ+CjxyZWN0IHg9IjMwIiB5PSI3OCIgd2lkdGg9IjExOCIgaGVpZ2h0PSI2MCIgcng9IjExIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6I2ZmZmZmZjtzdHJva2U6I2NiZDVlMSIvPgo8dGV4dCB4PSI4OSIgeT0iMTA0IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzBmMTcyYTsgZm9udC1zaXplOjEycHgiPmJ1aWxkIC8gcG9kczwvdGV4dD4KPHRleHQgeD0iODkiIHk9IjEyMiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGIiPmRvY2tlciBwdXNoIC8gcHVsbDwvdGV4dD4KPGxpbmUgeDE9IjE0OCIgeTE9IjEwOCIgeDI9IjIwNiIgeTI9IjEwOCIgc3Ryb2tlLXdpZHRoPSIyIiBtYXJrZXItZW5kPSJ1cmwoI2Vjcmh3LWdhcikiIHN0eWxlPSJzdHJva2U6Izk0YTNiOCIvPgo8cmVjdCB4PSIyMTAiIHk9Ijc4IiB3aWR0aD0iMTUwIiBoZWlnaHQ9IjYwIiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojZmZmZmZmO3N0cm9rZTojY2JkNWUxIi8+Cjx0ZXh0IHg9IjI4NSIgeT0iMTA0IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzBmMTcyYTsgZm9udC1zaXplOjEycHgiPkFtYXpvbiBFQ1I8L3RleHQ+Cjx0ZXh0IHg9IjI4NSIgeT0iMTIyIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YiI+QVdTLW1hbmFnZWQ8L3RleHQ+Cjx0ZXh0IHg9IjQxOCIgeT0iMzAiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMC41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwNDc4NTc7IGZvbnQtd2VpZ2h0OjcwMCI+c2V0IHVwIGF0IHRoZSBidWlsZDwvdGV4dD4KPHJlY3QgeD0iNDYyIiB5PSI0MCIgd2lkdGg9IjM2MiIgaGVpZ2h0PSIxMjAiIHJ4PSIxNCIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0cm9rZS1kYXNoYXJyYXk9IjUgNSIgc3R5bGU9ImZpbGw6I2Y4ZmFmYztzdHJva2U6I2NiZDVlMSIvPgo8dGV4dCB4PSI0NzYiIHk9IjYwIiBzdHlsZT0iZm9udDogNzAwIDEwcHggSW50ZXIsIHNhbnMtc2VyaWY7IGxldHRlci1zcGFjaW5nOiAxLjNweDsgZmlsbDogIzk0YTNiODsgZmlsbDojMDQ3ODU3Ij5PTiBHT09HTEUgQ0xPVUQ8L3RleHQ+CjxyZWN0IHg9IjQ3NiIgeT0iNzgiIHdpZHRoPSIxMDQiIGhlaWdodD0iNjAiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0eWxlPSJmaWxsOiNmZmZmZmY7c3Ryb2tlOiNjYmQ1ZTEiLz4KPHRleHQgeD0iNTI4IiB5PSIxMDQiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMGYxNzJhOyBmb250LXNpemU6MTJweCI+YnVpbGQgLyBwb2RzPC90ZXh0Pgo8dGV4dCB4PSI1MjgiIHk9IjEyMiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDYwMCAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMDQ3ODU3Ij5zYW1lIGNvbW1hbmRzPC90ZXh0Pgo8bGluZSB4MT0iNTgwIiB5MT0iMTA4IiB4Mj0iNjE2IiB5Mj0iMTA4IiBzdHJva2Utd2lkdGg9IjIiIG1hcmtlci1lbmQ9InVybCgjZWNyaHctZ2FyKSIgc3R5bGU9InN0cm9rZTojOTRhM2I4Ii8+CjxyZWN0IHg9IjYyMCIgeT0iNzQiIHdpZHRoPSIxODgiIGhlaWdodD0iNjgiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjciIHN0eWxlPSJmaWxsOiNlY2ZkZjU7c3Ryb2tlOiMwNDc4NTciLz4KPHRleHQgeD0iNzE0IiB5PSI5OSIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDcwMCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwNDc4NTc7IGZvbnQtc2l6ZToxMS41cHgiPkdvb2dsZSBBcnRpZmFjdCBSZWdpc3RyeTwvdGV4dD4KPHRleHQgeD0iNzE0IiB5PSIxMTUiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMHB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjNjQ3NDhiIj4mbHQ7bG9jYXRpb24mZ3Q7LWRvY2tlci5wa2cuZGV2PC90ZXh0Pgo8dGV4dCB4PSI3MTQiIHk9IjEzMSIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzA0Nzg1NyI+dGhlIHRhcmdldCBjbG91ZCdzIG5hdGl2ZSByZWdpc3RyeTwvdGV4dD4KPHRleHQgeD0iNjQzIiB5PSIxNzYiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMC41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwNDc4NTc7IGZvbnQtd2VpZ2h0OjcwMCI+VGVuc29yOSBpcyBub3QgaW4gdGhlIHB1bGwgcGF0aDwvdGV4dD4KPC9zdmc+)

![Before: on AWS your build pushes images to Amazon ECR and your workloads pull from it. After: on the target cloud the same docker push and pull reach Google Artifact Registry, provisioned at the build. Only the registry address is rewritten; the image is unchanged and Tensor9 is not in the pull path.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMTg0IiB2aWV3Qm94PSIwIDAgODM2IDE4NCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJCZWZvcmU6IG9uIEFXUyB5b3VyIGJ1aWxkIHB1c2hlcyBpbWFnZXMgdG8gQW1hem9uIEVDUiBhbmQgeW91ciB3b3JrbG9hZHMgcHVsbCBmcm9tIGl0LiBBZnRlcjogb24gdGhlIHRhcmdldCBjbG91ZCB0aGUgc2FtZSBkb2NrZXIgcHVzaCBhbmQgcHVsbCByZWFjaCBHb29nbGUgQXJ0aWZhY3QgUmVnaXN0cnksIHByb3Zpc2lvbmVkIGF0IHRoZSBidWlsZC4gT25seSB0aGUgcmVnaXN0cnkgYWRkcmVzcyBpcyByZXdyaXR0ZW47IHRoZSBpbWFnZSBpcyB1bmNoYW5nZWQgYW5kIFRlbnNvcjkgaXMgbm90IGluIHRoZSBwdWxsIHBhdGguIj48c3R5bGU+dGV4dHtmb250LWZhbWlseTpJbnRlciwtYXBwbGUtc3lzdGVtLEJsaW5rTWFjU3lzdGVtRm9udCwnU2Vnb2UgVUknLFJvYm90bywnSGVsdmV0aWNhIE5ldWUnLEFyaWFsLHNhbnMtc2VyaWY7ZmlsbDojY2JkNWUxfTwvc3R5bGU+CjxkZWZzPjxtYXJrZXIgaWQ9ImVjcmh3LWdhciIgdmlld0JveD0iMCAwIDEwIDEwIiByZWZYPSI4IiByZWZZPSI1IiBtYXJrZXJXaWR0aD0iNyIgbWFya2VySGVpZ2h0PSI3IiBvcmllbnQ9ImF1dG8tc3RhcnQtcmV2ZXJzZSI+PHBhdGggZD0iTTAsMCBMMTAsNSBMMCwxMCB6IiBzdHlsZT0iZmlsbDojNjQ3NDhiIi8+PC9tYXJrZXI+PC9kZWZzPgo8cmVjdCB4PSIxNiIgeT0iNDAiIHdpZHRoPSIzNTgiIGhlaWdodD0iMTIwIiByeD0iMTQiIHN0cm9rZS13aWR0aD0iMS40IiBzdHJva2UtZGFzaGFycmF5PSI1IDUiIHN0eWxlPSJmaWxsOiMwZjE3MmE7c3Ryb2tlOiM0NzU1NjkiLz4KPHRleHQgeD0iMzAiIHk9IjYwIiBzdHlsZT0iZm9udDogNzAwIDEwcHggSW50ZXIsIHNhbnMtc2VyaWY7IGxldHRlci1zcGFjaW5nOiAxLjNweDsgZmlsbDogIzY0NzQ4YjsgZmlsbDojOTRhM2I4Ij5PTiBBV1MgVE9EQVk8L3RleHQ+CjxyZWN0IHg9IjMwIiB5PSI3OCIgd2lkdGg9IjExOCIgaGVpZ2h0PSI2MCIgcng9IjExIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6IzFlMjkzYjtzdHJva2U6IzQ3NTU2OSIvPgo8dGV4dCB4PSI4OSIgeT0iMTA0IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogI2YxZjVmOTsgZm9udC1zaXplOjEycHgiPmJ1aWxkIC8gcG9kczwvdGV4dD4KPHRleHQgeD0iODkiIHk9IjEyMiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjgiPmRvY2tlciBwdXNoIC8gcHVsbDwvdGV4dD4KPGxpbmUgeDE9IjE0OCIgeTE9IjEwOCIgeDI9IjIwNiIgeTI9IjEwOCIgc3Ryb2tlLXdpZHRoPSIyIiBtYXJrZXItZW5kPSJ1cmwoI2Vjcmh3LWdhcikiIHN0eWxlPSJzdHJva2U6IzY0NzQ4YiIvPgo8cmVjdCB4PSIyMTAiIHk9Ijc4IiB3aWR0aD0iMTUwIiBoZWlnaHQ9IjYwIiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojMWUyOTNiO3N0cm9rZTojNDc1NTY5Ii8+Cjx0ZXh0IHg9IjI4NSIgeT0iMTA0IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogI2YxZjVmOTsgZm9udC1zaXplOjEycHgiPkFtYXpvbiBFQ1I8L3RleHQ+Cjx0ZXh0IHg9IjI4NSIgeT0iMTIyIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiOCI+QVdTLW1hbmFnZWQ8L3RleHQ+Cjx0ZXh0IHg9IjQxOCIgeT0iMzAiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMC41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2ZWU3Yjc7IGZvbnQtd2VpZ2h0OjcwMCI+c2V0IHVwIGF0IHRoZSBidWlsZDwvdGV4dD4KPHJlY3QgeD0iNDYyIiB5PSI0MCIgd2lkdGg9IjM2MiIgaGVpZ2h0PSIxMjAiIHJ4PSIxNCIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0cm9rZS1kYXNoYXJyYXk9IjUgNSIgc3R5bGU9ImZpbGw6IzBmMTcyYTtzdHJva2U6IzQ3NTU2OSIvPgo8dGV4dCB4PSI0NzYiIHk9IjYwIiBzdHlsZT0iZm9udDogNzAwIDEwcHggSW50ZXIsIHNhbnMtc2VyaWY7IGxldHRlci1zcGFjaW5nOiAxLjNweDsgZmlsbDogIzY0NzQ4YjsgZmlsbDojNmVlN2I3Ij5PTiBHT09HTEUgQ0xPVUQ8L3RleHQ+CjxyZWN0IHg9IjQ3NiIgeT0iNzgiIHdpZHRoPSIxMDQiIGhlaWdodD0iNjAiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0eWxlPSJmaWxsOiMxZTI5M2I7c3Ryb2tlOiM0NzU1NjkiLz4KPHRleHQgeD0iNTI4IiB5PSIxMDQiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjZjFmNWY5OyBmb250LXNpemU6MTJweCI+YnVpbGQgLyBwb2RzPC90ZXh0Pgo8dGV4dCB4PSI1MjgiIHk9IjEyMiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDYwMCAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNmVlN2I3Ij5zYW1lIGNvbW1hbmRzPC90ZXh0Pgo8bGluZSB4MT0iNTgwIiB5MT0iMTA4IiB4Mj0iNjE2IiB5Mj0iMTA4IiBzdHJva2Utd2lkdGg9IjIiIG1hcmtlci1lbmQ9InVybCgjZWNyaHctZ2FyKSIgc3R5bGU9InN0cm9rZTojNjQ3NDhiIi8+CjxyZWN0IHg9IjYyMCIgeT0iNzQiIHdpZHRoPSIxODgiIGhlaWdodD0iNjgiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjciIHN0eWxlPSJmaWxsOiMwNjRlM2I7c3Ryb2tlOiM2ZWU3YjciLz4KPHRleHQgeD0iNzE0IiB5PSI5OSIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDcwMCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2ZWU3Yjc7IGZvbnQtc2l6ZToxMS41cHgiPkdvb2dsZSBBcnRpZmFjdCBSZWdpc3RyeTwvdGV4dD4KPHRleHQgeD0iNzE0IiB5PSIxMTUiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMHB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjOTRhM2I4Ij4mbHQ7bG9jYXRpb24mZ3Q7LWRvY2tlci5wa2cuZGV2PC90ZXh0Pgo8dGV4dCB4PSI3MTQiIHk9IjEzMSIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzZlZTdiNyI+dGhlIHRhcmdldCBjbG91ZCdzIG5hdGl2ZSByZWdpc3RyeTwvdGV4dD4KPHRleHQgeD0iNjQzIiB5PSIxNzYiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMC41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2ZWU3Yjc7IGZvbnQtd2VpZ2h0OjcwMCI+VGVuc29yOSBpcyBub3QgaW4gdGhlIHB1bGwgcGF0aDwvdGV4dD4KPC9zdmc+)

Your ECR repositories are provisioned as Docker-format Artifact Registry repositories at the build; afterward your push and pull reach them directly and the image is unchanged.

#### Artifact Registry features

Artifact Registry hosts Docker/OCI images alongside Maven, npm, Python, Apt, Yum, and Go artifacts, so a container registry and a language-package registry are one system. Your ECR repositories map to **Docker-format** repositories, one per ECR repository, so the per-repository topology is preserved. Access is **per-repository IAM**, with read and write roles bound at the repository level rather than a single registry-wide policy.

GKE pulls images using the [node pool's IAM service account](https://docs.cloud.google.com/kubernetes-engine/security/configure-node-service-accounts), including when Workload Identity Federation is enabled for applications. Grant that node identity **Artifact Registry Reader** on the Artifact Registry repository. **Remote repositories** act as a pull-through cache of an upstream, and **virtual repositories** aggregate several repositories behind one endpoint. VPC Service Controls place the registry inside a service perimeter, and **customer-managed encryption keys (CMEK)** encrypt contents with your own Cloud KMS keys. **Cleanup policies** apply keep/delete rules per repository.

For a repository containing one image package, an unfiltered count policy keeps the ten newest versions by combining a delete rule for all versions with a keep rule for the ten most recent. Keep rules take precedence. This count mapping requires mutable tags, one count rule, and a version population whose target creation order matches its source push order. A single unfiltered age rule maps to a delete rule only when source and target age clocks agree. Additional image packages, tag selectors and overlapping ECR rules need a separate policy review; the target cleanup rules do not encode every ECR rule.

![Google Artifact Registry features](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjE2IiB2aWV3Qm94PSIwIDAgODM2IDIxNiIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJHb29nbGUgQXJ0aWZhY3QgUmVnaXN0cnkgZmVhdHVyZXMiPjxzdHlsZT50ZXh0e2ZvbnQtZmFtaWx5OkludGVyLC1hcHBsZS1zeXN0ZW0sQmxpbmtNYWNTeXN0ZW1Gb250LCdTZWdvZSBVSScsUm9ib3RvLCdIZWx2ZXRpY2EgTmV1ZScsQXJpYWwsc2Fucy1zZXJpZjtmaWxsOiMzMzQxNTV9PC9zdHlsZT4KPHRleHQgeD0iMjAiIHk9IjI2IiBzdHlsZT0iZm9udDogNzAwIDEwcHggSW50ZXIsIHNhbnMtc2VyaWY7IGxldHRlci1zcGFjaW5nOiAxLjNweDsgZmlsbDogIzk0YTNiODsgZmlsbDojMDQ3ODU3Ij5Hb29nbGUgQXJ0aWZhY3QgUmVnaXN0cnkgZmVhdHVyZXM8L3RleHQ+CjxyZWN0IHg9IjIwIiB5PSI0NCIgd2lkdGg9IjI1NiIgaGVpZ2h0PSI2NiIgcng9IjEwIiBzdHJva2Utd2lkdGg9IjEuNCIgc3R5bGU9ImZpbGw6I2VjZmRmNTtzdHJva2U6I2E3ZjNkMCIvPjx0ZXh0IHg9IjM2IiB5PSI3MSIgc3R5bGU9ImZvbnQ6IDcwMCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwNDc4NTc7IGZvbnQtc2l6ZToxMnB4Ij5NdWx0aS1mb3JtYXQgcmVwb3M8L3RleHQ+PHRleHQgeD0iMzYiIHk9IjkxIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YiI+RG9ja2VyLCBNYXZlbiwgbnBtLCBQeXRob24sIEdvPC90ZXh0PjxyZWN0IHg9IjI5NiIgeT0iNDQiIHdpZHRoPSIyNTYiIGhlaWdodD0iNjYiIHJ4PSIxMCIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0eWxlPSJmaWxsOiNlY2ZkZjU7c3Ryb2tlOiNhN2YzZDAiLz48dGV4dCB4PSIzMTIiIHk9IjcxIiBzdHlsZT0iZm9udDogNzAwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzA0Nzg1NzsgZm9udC1zaXplOjEycHgiPlBlci1yZXBvc2l0b3J5IElBTTwvdGV4dD48dGV4dCB4PSIzMTIiIHk9IjkxIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YiI+cm9sZXMgYm91bmQgcGVyIHJlcG88L3RleHQ+PHJlY3QgeD0iNTcyIiB5PSI0NCIgd2lkdGg9IjI1NiIgaGVpZ2h0PSI2NiIgcng9IjEwIiBzdHJva2Utd2lkdGg9IjEuNCIgc3R5bGU9ImZpbGw6I2VjZmRmNTtzdHJva2U6I2E3ZjNkMCIvPjx0ZXh0IHg9IjU4OCIgeT0iNzEiIHN0eWxlPSJmb250OiA3MDAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMDQ3ODU3OyBmb250LXNpemU6MTJweCI+R0tFIGltYWdlIHB1bGxzPC90ZXh0Pjx0ZXh0IHg9IjU4OCIgeT0iOTEiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiIj5ub2RlIHNlcnZpY2UgYWNjb3VudCArIHJlcG8gSUFNPC90ZXh0PjxyZWN0IHg9IjIwIiB5PSIxMjgiIHdpZHRoPSIyNTYiIGhlaWdodD0iNjYiIHJ4PSIxMCIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0eWxlPSJmaWxsOiNlY2ZkZjU7c3Ryb2tlOiNhN2YzZDAiLz48dGV4dCB4PSIzNiIgeT0iMTU1IiBzdHlsZT0iZm9udDogNzAwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzA0Nzg1NzsgZm9udC1zaXplOjEycHgiPlJlbW90ZSAmYW1wOyB2aXJ0dWFsIHJlcG9zPC90ZXh0Pjx0ZXh0IHg9IjM2IiB5PSIxNzUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiIj5wdWxsLXRocm91Z2ggKyBhZ2dyZWdhdGU8L3RleHQ+PHJlY3QgeD0iMjk2IiB5PSIxMjgiIHdpZHRoPSIyNTYiIGhlaWdodD0iNjYiIHJ4PSIxMCIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0eWxlPSJmaWxsOiNlY2ZkZjU7c3Ryb2tlOiNhN2YzZDAiLz48dGV4dCB4PSIzMTIiIHk9IjE1NSIgc3R5bGU9ImZvbnQ6IDcwMCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwNDc4NTc7IGZvbnQtc2l6ZToxMnB4Ij5WUEMgU2VydmljZSBDb250cm9sczwvdGV4dD48dGV4dCB4PSIzMTIiIHk9IjE3NSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGIiPnNlcnZpY2UgcGVyaW1ldGVyIMK3IENNRUs8L3RleHQ+PHJlY3QgeD0iNTcyIiB5PSIxMjgiIHdpZHRoPSIyNTYiIGhlaWdodD0iNjYiIHJ4PSIxMCIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0eWxlPSJmaWxsOiNlY2ZkZjU7c3Ryb2tlOiNhN2YzZDAiLz48dGV4dCB4PSI1ODgiIHk9IjE1NSIgc3R5bGU9ImZvbnQ6IDcwMCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwNDc4NTc7IGZvbnQtc2l6ZToxMnB4Ij5DbGVhbnVwIHBvbGljaWVzPC90ZXh0Pjx0ZXh0IHg9IjU4OCIgeT0iMTc1IiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YiI+cGVyLXJlcG8ga2VlcC9kZWxldGUgcnVsZXM8L3RleHQ+Cjwvc3ZnPg==)

![Google Artifact Registry features](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjE2IiB2aWV3Qm94PSIwIDAgODM2IDIxNiIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJHb29nbGUgQXJ0aWZhY3QgUmVnaXN0cnkgZmVhdHVyZXMiPjxzdHlsZT50ZXh0e2ZvbnQtZmFtaWx5OkludGVyLC1hcHBsZS1zeXN0ZW0sQmxpbmtNYWNTeXN0ZW1Gb250LCdTZWdvZSBVSScsUm9ib3RvLCdIZWx2ZXRpY2EgTmV1ZScsQXJpYWwsc2Fucy1zZXJpZjtmaWxsOiNjYmQ1ZTF9PC9zdHlsZT4KPHRleHQgeD0iMjAiIHk9IjI2IiBzdHlsZT0iZm9udDogNzAwIDEwcHggSW50ZXIsIHNhbnMtc2VyaWY7IGxldHRlci1zcGFjaW5nOiAxLjNweDsgZmlsbDogIzY0NzQ4YjsgZmlsbDojNmVlN2I3Ij5Hb29nbGUgQXJ0aWZhY3QgUmVnaXN0cnkgZmVhdHVyZXM8L3RleHQ+CjxyZWN0IHg9IjIwIiB5PSI0NCIgd2lkdGg9IjI1NiIgaGVpZ2h0PSI2NiIgcng9IjEwIiBzdHJva2Utd2lkdGg9IjEuNCIgc3R5bGU9ImZpbGw6IzA2NGUzYjtzdHJva2U6IzA0Nzg1NyIvPjx0ZXh0IHg9IjM2IiB5PSI3MSIgc3R5bGU9ImZvbnQ6IDcwMCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2ZWU3Yjc7IGZvbnQtc2l6ZToxMnB4Ij5NdWx0aS1mb3JtYXQgcmVwb3M8L3RleHQ+PHRleHQgeD0iMzYiIHk9IjkxIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiOCI+RG9ja2VyLCBNYXZlbiwgbnBtLCBQeXRob24sIEdvPC90ZXh0PjxyZWN0IHg9IjI5NiIgeT0iNDQiIHdpZHRoPSIyNTYiIGhlaWdodD0iNjYiIHJ4PSIxMCIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0eWxlPSJmaWxsOiMwNjRlM2I7c3Ryb2tlOiMwNDc4NTciLz48dGV4dCB4PSIzMTIiIHk9IjcxIiBzdHlsZT0iZm9udDogNzAwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzZlZTdiNzsgZm9udC1zaXplOjEycHgiPlBlci1yZXBvc2l0b3J5IElBTTwvdGV4dD48dGV4dCB4PSIzMTIiIHk9IjkxIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiOCI+cm9sZXMgYm91bmQgcGVyIHJlcG88L3RleHQ+PHJlY3QgeD0iNTcyIiB5PSI0NCIgd2lkdGg9IjI1NiIgaGVpZ2h0PSI2NiIgcng9IjEwIiBzdHJva2Utd2lkdGg9IjEuNCIgc3R5bGU9ImZpbGw6IzA2NGUzYjtzdHJva2U6IzA0Nzg1NyIvPjx0ZXh0IHg9IjU4OCIgeT0iNzEiIHN0eWxlPSJmb250OiA3MDAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNmVlN2I3OyBmb250LXNpemU6MTJweCI+R0tFIGltYWdlIHB1bGxzPC90ZXh0Pjx0ZXh0IHg9IjU4OCIgeT0iOTEiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4Ij5ub2RlIHNlcnZpY2UgYWNjb3VudCArIHJlcG8gSUFNPC90ZXh0PjxyZWN0IHg9IjIwIiB5PSIxMjgiIHdpZHRoPSIyNTYiIGhlaWdodD0iNjYiIHJ4PSIxMCIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0eWxlPSJmaWxsOiMwNjRlM2I7c3Ryb2tlOiMwNDc4NTciLz48dGV4dCB4PSIzNiIgeT0iMTU1IiBzdHlsZT0iZm9udDogNzAwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzZlZTdiNzsgZm9udC1zaXplOjEycHgiPlJlbW90ZSAmYW1wOyB2aXJ0dWFsIHJlcG9zPC90ZXh0Pjx0ZXh0IHg9IjM2IiB5PSIxNzUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4Ij5wdWxsLXRocm91Z2ggKyBhZ2dyZWdhdGU8L3RleHQ+PHJlY3QgeD0iMjk2IiB5PSIxMjgiIHdpZHRoPSIyNTYiIGhlaWdodD0iNjYiIHJ4PSIxMCIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0eWxlPSJmaWxsOiMwNjRlM2I7c3Ryb2tlOiMwNDc4NTciLz48dGV4dCB4PSIzMTIiIHk9IjE1NSIgc3R5bGU9ImZvbnQ6IDcwMCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2ZWU3Yjc7IGZvbnQtc2l6ZToxMnB4Ij5WUEMgU2VydmljZSBDb250cm9sczwvdGV4dD48dGV4dCB4PSIzMTIiIHk9IjE3NSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjgiPnNlcnZpY2UgcGVyaW1ldGVyIMK3IENNRUs8L3RleHQ+PHJlY3QgeD0iNTcyIiB5PSIxMjgiIHdpZHRoPSIyNTYiIGhlaWdodD0iNjYiIHJ4PSIxMCIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0eWxlPSJmaWxsOiMwNjRlM2I7c3Ryb2tlOiMwNDc4NTciLz48dGV4dCB4PSI1ODgiIHk9IjE1NSIgc3R5bGU9ImZvbnQ6IDcwMCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2ZWU3Yjc7IGZvbnQtc2l6ZToxMnB4Ij5DbGVhbnVwIHBvbGljaWVzPC90ZXh0Pjx0ZXh0IHg9IjU4OCIgeT0iMTc1IiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiOCI+cGVyLXJlcG8ga2VlcC9kZWxldGUgcnVsZXM8L3RleHQ+Cjwvc3ZnPg==)

Artifact Registry package formats, authentication, and retention.

#### Limitations

Where ECR and Artifact Registry stay different

* **Access control behaves differently: it uses Google IAM.** Image pulls use the node identity or separately configured registry credentials; the permission model is per-repository IAM rather than ECR resource policies.
* **ECR enhanced scanning is not supported.** Artifact Analysis replaces it with on-push and continuous analysis, which have their own coverage and cadence.
* **Lifecycle rules behave differently.** The count/age mapping covers one image package with no tag filter or overlapping priorities. ECR requires all listed tag selectors to match; Google prefix lists match any prefix. Google recent-count rules cannot also select tagged or untagged versions. Keep wins over delete, and immutable tagged versions cannot be deleted. Target age starts at creation in Artifact Registry; source image ages and archive transitions are not preserved.
* **ECR replication rules are not supported.** Multi-region storage does not select ECR destination regions or accounts. Remote repositories cache on the first pull and need their upstream for uncached content. Virtual repositories aggregate upstreams in the same region or multi-region; neither mechanism supplies destination push replication. Deliver required regional copies through your pipeline.

#### Other considerations

Plan image delivery, credentials, and storage costs for the target registry.

* **Push images from your build pipeline.** The build creates one Docker-format Artifact Registry repository per ECR repository. Point your pipeline at `<location>-docker.pkg.dev` and push there yourself; image traffic does not go through Tensor9.
* **Authorize the image-pulling identity.** Grant the GKE node service account read access to the Artifact Registry repository, including for cross-project pulls. Application workload federation does not grant this node permission.
* **Review retention before deletion.** Use Artifact Registry's cleanup dry run to inspect the versions selected by the keep/delete policy. Preserve deployment and rollback images, and review policies outside the single-image-package count/age mapping separately.
* **Deliver regional image copies explicitly.** Push the required digests to each selected target repository. A multi-region location or an uncached remote repository does not replace the ECR destination rule set.
* **Storage and network egress are billed.** Artifact Registry bills for stored bytes and network egress rather than an ECR-style model, and CMEK ties contents to your Cloud KMS keys if you enable it.

## On OCI

### OCI Container Registry

| Operation | Area | Support | Depth | Notes |
| - | - | - | - | - |
| Registry authentication | Auth | Supported | Common | handled by the OCI instance-principal credential helper, in-tenancy; no static secret in the pull path |
| docker push / pull | Image path | Supported | Common | byte-identical OCI Distribution v2; manifest, layers and SHA-256 digest unchanged; host and repository references are rewritten |
| Image tag policy mapping | Immutability | Supported | Most usage | per-repository immutability, set from your ECR tag-mutability setting |
| Lifecycle policy mapping | Lifecycle | Partial | Most usage | ECR per-repo lifecycle rules are surfaced at the build; OCIR provides its own image retention policies (region-wide by default, overridable for specific repositories) that you configure separately |
| Replication config | Replication | Out of scope | Full surface | OCIR replication is configured separately and is not translated by default |
| Repository provisioning | Repositories | Supported | Common | one OCI repository per ECR repository (N to N); the repository name is normalized to lowercase with slash-nesting and no underscore |
| Scan-on-push findings | Scanning | Partial | Most usage | served by OCI Vulnerability Scanning, a native scanner with different coverage than ECR enhanced |

#### How it works

On AWS your build pushes container images to **Amazon ECR** and your workloads pull from it. **OCI Container Registry** is Oracle Cloud's managed registry, organized around your tenancy: repositories live under your tenancy's namespace, are scoped to compartments, and authenticate through OCI IAM. At the build, Tensor9 reads your ECR repositories and provisions one OCI repository for each; afterward your own `docker push` and `docker pull` reach it directly, without routing image traffic through Tensor9.

The image itself never changes. ECR and OCI Container Registry both speak the **OCI Distribution v2** protocol, so your image manifest, its layer blobs, and their content digests are byte-identical on both sides; docker and containerd are untouched. The target image reference uses `<region>.ocir.io/<namespace>/<repo>`, with the mapped repository path.

This mapping provisions a target registry and updates image references. Docker and containerd use the target registry's own protocol and credentials. It does not provide the AWS ECR management or authorization-token API: an application that calls ECR directly, including `GetAuthorizationToken`, needs a separate integration.

![Before: on AWS your build pushes images to Amazon ECR and your workloads pull from it. After: on the target cloud the same docker push and pull reach OCI Container Registry, provisioned at the build. Only the registry address is rewritten; the image is unchanged and Tensor9 is not in the pull path.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMTg0IiB2aWV3Qm94PSIwIDAgODM2IDE4NCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJCZWZvcmU6IG9uIEFXUyB5b3VyIGJ1aWxkIHB1c2hlcyBpbWFnZXMgdG8gQW1hem9uIEVDUiBhbmQgeW91ciB3b3JrbG9hZHMgcHVsbCBmcm9tIGl0LiBBZnRlcjogb24gdGhlIHRhcmdldCBjbG91ZCB0aGUgc2FtZSBkb2NrZXIgcHVzaCBhbmQgcHVsbCByZWFjaCBPQ0kgQ29udGFpbmVyIFJlZ2lzdHJ5LCBwcm92aXNpb25lZCBhdCB0aGUgYnVpbGQuIE9ubHkgdGhlIHJlZ2lzdHJ5IGFkZHJlc3MgaXMgcmV3cml0dGVuOyB0aGUgaW1hZ2UgaXMgdW5jaGFuZ2VkIGFuZCBUZW5zb3I5IGlzIG5vdCBpbiB0aGUgcHVsbCBwYXRoLiI+PHN0eWxlPnRleHR7Zm9udC1mYW1pbHk6SW50ZXIsLWFwcGxlLXN5c3RlbSxCbGlua01hY1N5c3RlbUZvbnQsJ1NlZ29lIFVJJyxSb2JvdG8sJ0hlbHZldGljYSBOZXVlJyxBcmlhbCxzYW5zLXNlcmlmO2ZpbGw6IzMzNDE1NX08L3N0eWxlPgo8ZGVmcz48bWFya2VyIGlkPSJlY3Jody1vY2lyIiB2aWV3Qm94PSIwIDAgMTAgMTAiIHJlZlg9IjgiIHJlZlk9IjUiIG1hcmtlcldpZHRoPSI3IiBtYXJrZXJIZWlnaHQ9IjciIG9yaWVudD0iYXV0by1zdGFydC1yZXZlcnNlIj48cGF0aCBkPSJNMCwwIEwxMCw1IEwwLDEwIHoiIHN0eWxlPSJmaWxsOiM5NGEzYjgiLz48L21hcmtlcj48L2RlZnM+CjxyZWN0IHg9IjE2IiB5PSI0MCIgd2lkdGg9IjM1OCIgaGVpZ2h0PSIxMjAiIHJ4PSIxNCIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0cm9rZS1kYXNoYXJyYXk9IjUgNSIgc3R5bGU9ImZpbGw6I2Y4ZmFmYztzdHJva2U6I2NiZDVlMSIvPgo8dGV4dCB4PSIzMCIgeT0iNjAiIHN0eWxlPSJmb250OiA3MDAgMTBweCBJbnRlciwgc2Fucy1zZXJpZjsgbGV0dGVyLXNwYWNpbmc6IDEuM3B4OyBmaWxsOiAjOTRhM2I4OyBmaWxsOiM2NDc0OGIiPk9OIEFXUyBUT0RBWTwvdGV4dD4KPHJlY3QgeD0iMzAiIHk9Ijc4IiB3aWR0aD0iMTE4IiBoZWlnaHQ9IjYwIiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojZmZmZmZmO3N0cm9rZTojY2JkNWUxIi8+Cjx0ZXh0IHg9Ijg5IiB5PSIxMDQiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMGYxNzJhOyBmb250LXNpemU6MTJweCI+YnVpbGQgLyBwb2RzPC90ZXh0Pgo8dGV4dCB4PSI4OSIgeT0iMTIyIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YiI+ZG9ja2VyIHB1c2ggLyBwdWxsPC90ZXh0Pgo8bGluZSB4MT0iMTQ4IiB5MT0iMTA4IiB4Mj0iMjA2IiB5Mj0iMTA4IiBzdHJva2Utd2lkdGg9IjIiIG1hcmtlci1lbmQ9InVybCgjZWNyaHctb2NpcikiIHN0eWxlPSJzdHJva2U6Izk0YTNiOCIvPgo8cmVjdCB4PSIyMTAiIHk9Ijc4IiB3aWR0aD0iMTUwIiBoZWlnaHQ9IjYwIiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojZmZmZmZmO3N0cm9rZTojY2JkNWUxIi8+Cjx0ZXh0IHg9IjI4NSIgeT0iMTA0IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzBmMTcyYTsgZm9udC1zaXplOjEycHgiPkFtYXpvbiBFQ1I8L3RleHQ+Cjx0ZXh0IHg9IjI4NSIgeT0iMTIyIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YiI+QVdTLW1hbmFnZWQ8L3RleHQ+Cjx0ZXh0IHg9IjQxOCIgeT0iMzAiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMC41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwNDc4NTc7IGZvbnQtd2VpZ2h0OjcwMCI+c2V0IHVwIGF0IHRoZSBidWlsZDwvdGV4dD4KPHJlY3QgeD0iNDYyIiB5PSI0MCIgd2lkdGg9IjM2MiIgaGVpZ2h0PSIxMjAiIHJ4PSIxNCIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0cm9rZS1kYXNoYXJyYXk9IjUgNSIgc3R5bGU9ImZpbGw6I2Y4ZmFmYztzdHJva2U6I2NiZDVlMSIvPgo8dGV4dCB4PSI0NzYiIHk9IjYwIiBzdHlsZT0iZm9udDogNzAwIDEwcHggSW50ZXIsIHNhbnMtc2VyaWY7IGxldHRlci1zcGFjaW5nOiAxLjNweDsgZmlsbDogIzk0YTNiODsgZmlsbDojMDQ3ODU3Ij5PTiBPQ0kgVEVOQU5DWTwvdGV4dD4KPHJlY3QgeD0iNDc2IiB5PSI3OCIgd2lkdGg9IjEwNCIgaGVpZ2h0PSI2MCIgcng9IjExIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6I2ZmZmZmZjtzdHJva2U6I2NiZDVlMSIvPgo8dGV4dCB4PSI1MjgiIHk9IjEwNCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwZjE3MmE7IGZvbnQtc2l6ZToxMnB4Ij5idWlsZCAvIHBvZHM8L3RleHQ+Cjx0ZXh0IHg9IjUyOCIgeT0iMTIyIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjAwIDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwNDc4NTciPnNhbWUgY29tbWFuZHM8L3RleHQ+CjxsaW5lIHgxPSI1ODAiIHkxPSIxMDgiIHgyPSI2MTYiIHkyPSIxMDgiIHN0cm9rZS13aWR0aD0iMiIgbWFya2VyLWVuZD0idXJsKCNlY3Jody1vY2lyKSIgc3R5bGU9InN0cm9rZTojOTRhM2I4Ii8+CjxyZWN0IHg9IjYyMCIgeT0iNzQiIHdpZHRoPSIxODgiIGhlaWdodD0iNjgiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjciIHN0eWxlPSJmaWxsOiNlY2ZkZjU7c3Ryb2tlOiMwNDc4NTciLz4KPHRleHQgeD0iNzE0IiB5PSI5OSIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDcwMCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwNDc4NTc7IGZvbnQtc2l6ZToxMS41cHgiPk9DSSBDb250YWluZXIgUmVnaXN0cnk8L3RleHQ+Cjx0ZXh0IHg9IjcxNCIgeT0iMTE1IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTBweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzY0NzQ4YiI+Jmx0O3JlZ2lvbiZndDsub2Npci5pby8mbHQ7bnMmZ3Q7PC90ZXh0Pgo8dGV4dCB4PSI3MTQiIHk9IjEzMSIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzA0Nzg1NyI+dGhlIHRhcmdldCBjbG91ZCdzIG5hdGl2ZSByZWdpc3RyeTwvdGV4dD4KPHRleHQgeD0iNjQzIiB5PSIxNzYiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMC41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwNDc4NTc7IGZvbnQtd2VpZ2h0OjcwMCI+VGVuc29yOSBpcyBub3QgaW4gdGhlIHB1bGwgcGF0aDwvdGV4dD4KPC9zdmc+)

![Before: on AWS your build pushes images to Amazon ECR and your workloads pull from it. After: on the target cloud the same docker push and pull reach OCI Container Registry, provisioned at the build. Only the registry address is rewritten; the image is unchanged and Tensor9 is not in the pull path.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMTg0IiB2aWV3Qm94PSIwIDAgODM2IDE4NCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJCZWZvcmU6IG9uIEFXUyB5b3VyIGJ1aWxkIHB1c2hlcyBpbWFnZXMgdG8gQW1hem9uIEVDUiBhbmQgeW91ciB3b3JrbG9hZHMgcHVsbCBmcm9tIGl0LiBBZnRlcjogb24gdGhlIHRhcmdldCBjbG91ZCB0aGUgc2FtZSBkb2NrZXIgcHVzaCBhbmQgcHVsbCByZWFjaCBPQ0kgQ29udGFpbmVyIFJlZ2lzdHJ5LCBwcm92aXNpb25lZCBhdCB0aGUgYnVpbGQuIE9ubHkgdGhlIHJlZ2lzdHJ5IGFkZHJlc3MgaXMgcmV3cml0dGVuOyB0aGUgaW1hZ2UgaXMgdW5jaGFuZ2VkIGFuZCBUZW5zb3I5IGlzIG5vdCBpbiB0aGUgcHVsbCBwYXRoLiI+PHN0eWxlPnRleHR7Zm9udC1mYW1pbHk6SW50ZXIsLWFwcGxlLXN5c3RlbSxCbGlua01hY1N5c3RlbUZvbnQsJ1NlZ29lIFVJJyxSb2JvdG8sJ0hlbHZldGljYSBOZXVlJyxBcmlhbCxzYW5zLXNlcmlmO2ZpbGw6I2NiZDVlMX08L3N0eWxlPgo8ZGVmcz48bWFya2VyIGlkPSJlY3Jody1vY2lyIiB2aWV3Qm94PSIwIDAgMTAgMTAiIHJlZlg9IjgiIHJlZlk9IjUiIG1hcmtlcldpZHRoPSI3IiBtYXJrZXJIZWlnaHQ9IjciIG9yaWVudD0iYXV0by1zdGFydC1yZXZlcnNlIj48cGF0aCBkPSJNMCwwIEwxMCw1IEwwLDEwIHoiIHN0eWxlPSJmaWxsOiM2NDc0OGIiLz48L21hcmtlcj48L2RlZnM+CjxyZWN0IHg9IjE2IiB5PSI0MCIgd2lkdGg9IjM1OCIgaGVpZ2h0PSIxMjAiIHJ4PSIxNCIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0cm9rZS1kYXNoYXJyYXk9IjUgNSIgc3R5bGU9ImZpbGw6IzBmMTcyYTtzdHJva2U6IzQ3NTU2OSIvPgo8dGV4dCB4PSIzMCIgeT0iNjAiIHN0eWxlPSJmb250OiA3MDAgMTBweCBJbnRlciwgc2Fucy1zZXJpZjsgbGV0dGVyLXNwYWNpbmc6IDEuM3B4OyBmaWxsOiAjNjQ3NDhiOyBmaWxsOiM5NGEzYjgiPk9OIEFXUyBUT0RBWTwvdGV4dD4KPHJlY3QgeD0iMzAiIHk9Ijc4IiB3aWR0aD0iMTE4IiBoZWlnaHQ9IjYwIiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojMWUyOTNiO3N0cm9rZTojNDc1NTY5Ii8+Cjx0ZXh0IHg9Ijg5IiB5PSIxMDQiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjZjFmNWY5OyBmb250LXNpemU6MTJweCI+YnVpbGQgLyBwb2RzPC90ZXh0Pgo8dGV4dCB4PSI4OSIgeT0iMTIyIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiOCI+ZG9ja2VyIHB1c2ggLyBwdWxsPC90ZXh0Pgo8bGluZSB4MT0iMTQ4IiB5MT0iMTA4IiB4Mj0iMjA2IiB5Mj0iMTA4IiBzdHJva2Utd2lkdGg9IjIiIG1hcmtlci1lbmQ9InVybCgjZWNyaHctb2NpcikiIHN0eWxlPSJzdHJva2U6IzY0NzQ4YiIvPgo8cmVjdCB4PSIyMTAiIHk9Ijc4IiB3aWR0aD0iMTUwIiBoZWlnaHQ9IjYwIiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojMWUyOTNiO3N0cm9rZTojNDc1NTY5Ii8+Cjx0ZXh0IHg9IjI4NSIgeT0iMTA0IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogI2YxZjVmOTsgZm9udC1zaXplOjEycHgiPkFtYXpvbiBFQ1I8L3RleHQ+Cjx0ZXh0IHg9IjI4NSIgeT0iMTIyIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiOCI+QVdTLW1hbmFnZWQ8L3RleHQ+Cjx0ZXh0IHg9IjQxOCIgeT0iMzAiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMC41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2ZWU3Yjc7IGZvbnQtd2VpZ2h0OjcwMCI+c2V0IHVwIGF0IHRoZSBidWlsZDwvdGV4dD4KPHJlY3QgeD0iNDYyIiB5PSI0MCIgd2lkdGg9IjM2MiIgaGVpZ2h0PSIxMjAiIHJ4PSIxNCIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0cm9rZS1kYXNoYXJyYXk9IjUgNSIgc3R5bGU9ImZpbGw6IzBmMTcyYTtzdHJva2U6IzQ3NTU2OSIvPgo8dGV4dCB4PSI0NzYiIHk9IjYwIiBzdHlsZT0iZm9udDogNzAwIDEwcHggSW50ZXIsIHNhbnMtc2VyaWY7IGxldHRlci1zcGFjaW5nOiAxLjNweDsgZmlsbDogIzY0NzQ4YjsgZmlsbDojNmVlN2I3Ij5PTiBPQ0kgVEVOQU5DWTwvdGV4dD4KPHJlY3QgeD0iNDc2IiB5PSI3OCIgd2lkdGg9IjEwNCIgaGVpZ2h0PSI2MCIgcng9IjExIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6IzFlMjkzYjtzdHJva2U6IzQ3NTU2OSIvPgo8dGV4dCB4PSI1MjgiIHk9IjEwNCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICNmMWY1Zjk7IGZvbnQtc2l6ZToxMnB4Ij5idWlsZCAvIHBvZHM8L3RleHQ+Cjx0ZXh0IHg9IjUyOCIgeT0iMTIyIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjAwIDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2ZWU3YjciPnNhbWUgY29tbWFuZHM8L3RleHQ+CjxsaW5lIHgxPSI1ODAiIHkxPSIxMDgiIHgyPSI2MTYiIHkyPSIxMDgiIHN0cm9rZS13aWR0aD0iMiIgbWFya2VyLWVuZD0idXJsKCNlY3Jody1vY2lyKSIgc3R5bGU9InN0cm9rZTojNjQ3NDhiIi8+CjxyZWN0IHg9IjYyMCIgeT0iNzQiIHdpZHRoPSIxODgiIGhlaWdodD0iNjgiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjciIHN0eWxlPSJmaWxsOiMwNjRlM2I7c3Ryb2tlOiM2ZWU3YjciLz4KPHRleHQgeD0iNzE0IiB5PSI5OSIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDcwMCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2ZWU3Yjc7IGZvbnQtc2l6ZToxMS41cHgiPk9DSSBDb250YWluZXIgUmVnaXN0cnk8L3RleHQ+Cjx0ZXh0IHg9IjcxNCIgeT0iMTE1IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTBweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzk0YTNiOCI+Jmx0O3JlZ2lvbiZndDsub2Npci5pby8mbHQ7bnMmZ3Q7PC90ZXh0Pgo8dGV4dCB4PSI3MTQiIHk9IjEzMSIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzZlZTdiNyI+dGhlIHRhcmdldCBjbG91ZCdzIG5hdGl2ZSByZWdpc3RyeTwvdGV4dD4KPHRleHQgeD0iNjQzIiB5PSIxNzYiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMC41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2ZWU3Yjc7IGZvbnQtd2VpZ2h0OjcwMCI+VGVuc29yOSBpcyBub3QgaW4gdGhlIHB1bGwgcGF0aDwvdGV4dD4KPC9zdmc+)

Your ECR repositories are provisioned as tenancy-namespaced OCI repositories at the build; afterward your push and pull reach them directly and the image is unchanged.

#### OCI Container Registry features

OCI Container Registry is organized around your **tenancy**. Every repository name is prefixed by your tenancy's object-storage namespace (`<namespace>/<repo>`, with slash-nested paths), and repositories are scoped to **compartments** for access control and billing. Your ECR repositories map **one-to-one** to OCI repositories, so the per-repository topology is preserved, and each keeps an **immutability** flag matching your ECR tag-mutability setting.

Authentication is **OCI IAM**: a workload pulls with an auth token, or with an instance or workload principal through the configured credential helper. An auth token is a credential that you must store and rotate; the principal-based helper avoids a static registry token. The registry is **regional**, with cross-region image copy for multi-region estates, and **OCI Vulnerability Scanning** provides native image scanning. Image retention policies apply region-wide by default and can be overridden with custom policies for specific repositories, deleting images that have not been pulled or versioned within a set number of days.

![OCI Container Registry features](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjE2IiB2aWV3Qm94PSIwIDAgODM2IDIxNiIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJPQ0kgQ29udGFpbmVyIFJlZ2lzdHJ5IGZlYXR1cmVzIj48c3R5bGU+dGV4dHtmb250LWZhbWlseTpJbnRlciwtYXBwbGUtc3lzdGVtLEJsaW5rTWFjU3lzdGVtRm9udCwnU2Vnb2UgVUknLFJvYm90bywnSGVsdmV0aWNhIE5ldWUnLEFyaWFsLHNhbnMtc2VyaWY7ZmlsbDojMzM0MTU1fTwvc3R5bGU+Cjx0ZXh0IHg9IjIwIiB5PSIyNiIgc3R5bGU9ImZvbnQ6IDcwMCAxMHB4IEludGVyLCBzYW5zLXNlcmlmOyBsZXR0ZXItc3BhY2luZzogMS4zcHg7IGZpbGw6ICM5NGEzYjg7IGZpbGw6IzA0Nzg1NyI+T0NJIENvbnRhaW5lciBSZWdpc3RyeSBmZWF0dXJlczwvdGV4dD4KPHJlY3QgeD0iMjAiIHk9IjQ0IiB3aWR0aD0iMjU2IiBoZWlnaHQ9IjY2IiByeD0iMTAiIHN0cm9rZS13aWR0aD0iMS40IiBzdHlsZT0iZmlsbDojZWNmZGY1O3N0cm9rZTojYTdmM2QwIi8+PHRleHQgeD0iMzYiIHk9IjcxIiBzdHlsZT0iZm9udDogNzAwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzA0Nzg1NzsgZm9udC1zaXplOjEycHgiPlRlbmFuY3ktbmFtZXNwYWNlZDwvdGV4dD48dGV4dCB4PSIzNiIgeT0iOTEiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiIj4mbHQ7bmFtZXNwYWNlJmd0Oy8mbHQ7cmVwbyZndDsgwrcgY29tcGFydG1lbnRzPC90ZXh0PjxyZWN0IHg9IjI5NiIgeT0iNDQiIHdpZHRoPSIyNTYiIGhlaWdodD0iNjYiIHJ4PSIxMCIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0eWxlPSJmaWxsOiNlY2ZkZjU7c3Ryb2tlOiNhN2YzZDAiLz48dGV4dCB4PSIzMTIiIHk9IjcxIiBzdHlsZT0iZm9udDogNzAwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzA0Nzg1NzsgZm9udC1zaXplOjEycHgiPk9DSSBJQU0gYXV0aCB0b2tlbnM8L3RleHQ+PHRleHQgeD0iMzEyIiB5PSI5MSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGIiPnRva2VuIG9yIGluc3RhbmNlIHByaW5jaXBhbDwvdGV4dD48cmVjdCB4PSI1NzIiIHk9IjQ0IiB3aWR0aD0iMjU2IiBoZWlnaHQ9IjY2IiByeD0iMTAiIHN0cm9rZS13aWR0aD0iMS40IiBzdHlsZT0iZmlsbDojZWNmZGY1O3N0cm9rZTojYTdmM2QwIi8+PHRleHQgeD0iNTg4IiB5PSI3MSIgc3R5bGU9ImZvbnQ6IDcwMCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwNDc4NTc7IGZvbnQtc2l6ZToxMnB4Ij5SZWdpb25hbCByZWdpc3RyeTwvdGV4dD48dGV4dCB4PSI1ODgiIHk9IjkxIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YiI+Y3Jvc3MtcmVnaW9uIGltYWdlIGNvcHk8L3RleHQ+PHJlY3QgeD0iMjAiIHk9IjEyOCIgd2lkdGg9IjI1NiIgaGVpZ2h0PSI2NiIgcng9IjEwIiBzdHJva2Utd2lkdGg9IjEuNCIgc3R5bGU9ImZpbGw6I2VjZmRmNTtzdHJva2U6I2E3ZjNkMCIvPjx0ZXh0IHg9IjM2IiB5PSIxNTUiIHN0eWxlPSJmb250OiA3MDAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMDQ3ODU3OyBmb250LXNpemU6MTJweCI+UGVyLXJlcG8gaW1tdXRhYmlsaXR5PC90ZXh0Pjx0ZXh0IHg9IjM2IiB5PSIxNzUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiIj5pbW11dGFibGUtcmVwb3NpdG9yeSBzZXR0aW5nPC90ZXh0PjxyZWN0IHg9IjI5NiIgeT0iMTI4IiB3aWR0aD0iMjU2IiBoZWlnaHQ9IjY2IiByeD0iMTAiIHN0cm9rZS13aWR0aD0iMS40IiBzdHlsZT0iZmlsbDojZWNmZGY1O3N0cm9rZTojYTdmM2QwIi8+PHRleHQgeD0iMzEyIiB5PSIxNTUiIHN0eWxlPSJmb250OiA3MDAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMDQ3ODU3OyBmb250LXNpemU6MTJweCI+VnVsbmVyYWJpbGl0eSBzY2FubmluZzwvdGV4dD48dGV4dCB4PSIzMTIiIHk9IjE3NSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGIiPk9DSSBWdWxuZXJhYmlsaXR5IFNjYW5uaW5nPC90ZXh0PjxyZWN0IHg9IjU3MiIgeT0iMTI4IiB3aWR0aD0iMjU2IiBoZWlnaHQ9IjY2IiByeD0iMTAiIHN0cm9rZS13aWR0aD0iMS40IiBzdHlsZT0iZmlsbDojZWNmZGY1O3N0cm9rZTojYTdmM2QwIi8+PHRleHQgeD0iNTg4IiB5PSIxNTUiIHN0eWxlPSJmb250OiA3MDAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMDQ3ODU3OyBmb250LXNpemU6MTJweCI+SW1hZ2UgcmV0ZW50aW9uIHBvbGljaWVzPC90ZXh0Pjx0ZXh0IHg9IjU4OCIgeT0iMTc1IiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YiI+cmVnaW9uIGRlZmF1bHQgwrcgcGVyLXJlcG8gY3VzdG9tPC90ZXh0Pgo8L3N2Zz4=)

![OCI Container Registry features](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjE2IiB2aWV3Qm94PSIwIDAgODM2IDIxNiIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJPQ0kgQ29udGFpbmVyIFJlZ2lzdHJ5IGZlYXR1cmVzIj48c3R5bGU+dGV4dHtmb250LWZhbWlseTpJbnRlciwtYXBwbGUtc3lzdGVtLEJsaW5rTWFjU3lzdGVtRm9udCwnU2Vnb2UgVUknLFJvYm90bywnSGVsdmV0aWNhIE5ldWUnLEFyaWFsLHNhbnMtc2VyaWY7ZmlsbDojY2JkNWUxfTwvc3R5bGU+Cjx0ZXh0IHg9IjIwIiB5PSIyNiIgc3R5bGU9ImZvbnQ6IDcwMCAxMHB4IEludGVyLCBzYW5zLXNlcmlmOyBsZXR0ZXItc3BhY2luZzogMS4zcHg7IGZpbGw6ICM2NDc0OGI7IGZpbGw6IzZlZTdiNyI+T0NJIENvbnRhaW5lciBSZWdpc3RyeSBmZWF0dXJlczwvdGV4dD4KPHJlY3QgeD0iMjAiIHk9IjQ0IiB3aWR0aD0iMjU2IiBoZWlnaHQ9IjY2IiByeD0iMTAiIHN0cm9rZS13aWR0aD0iMS40IiBzdHlsZT0iZmlsbDojMDY0ZTNiO3N0cm9rZTojMDQ3ODU3Ii8+PHRleHQgeD0iMzYiIHk9IjcxIiBzdHlsZT0iZm9udDogNzAwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzZlZTdiNzsgZm9udC1zaXplOjEycHgiPlRlbmFuY3ktbmFtZXNwYWNlZDwvdGV4dD48dGV4dCB4PSIzNiIgeT0iOTEiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4Ij4mbHQ7bmFtZXNwYWNlJmd0Oy8mbHQ7cmVwbyZndDsgwrcgY29tcGFydG1lbnRzPC90ZXh0PjxyZWN0IHg9IjI5NiIgeT0iNDQiIHdpZHRoPSIyNTYiIGhlaWdodD0iNjYiIHJ4PSIxMCIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0eWxlPSJmaWxsOiMwNjRlM2I7c3Ryb2tlOiMwNDc4NTciLz48dGV4dCB4PSIzMTIiIHk9IjcxIiBzdHlsZT0iZm9udDogNzAwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzZlZTdiNzsgZm9udC1zaXplOjEycHgiPk9DSSBJQU0gYXV0aCB0b2tlbnM8L3RleHQ+PHRleHQgeD0iMzEyIiB5PSI5MSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjgiPnRva2VuIG9yIGluc3RhbmNlIHByaW5jaXBhbDwvdGV4dD48cmVjdCB4PSI1NzIiIHk9IjQ0IiB3aWR0aD0iMjU2IiBoZWlnaHQ9IjY2IiByeD0iMTAiIHN0cm9rZS13aWR0aD0iMS40IiBzdHlsZT0iZmlsbDojMDY0ZTNiO3N0cm9rZTojMDQ3ODU3Ii8+PHRleHQgeD0iNTg4IiB5PSI3MSIgc3R5bGU9ImZvbnQ6IDcwMCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2ZWU3Yjc7IGZvbnQtc2l6ZToxMnB4Ij5SZWdpb25hbCByZWdpc3RyeTwvdGV4dD48dGV4dCB4PSI1ODgiIHk9IjkxIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiOCI+Y3Jvc3MtcmVnaW9uIGltYWdlIGNvcHk8L3RleHQ+PHJlY3QgeD0iMjAiIHk9IjEyOCIgd2lkdGg9IjI1NiIgaGVpZ2h0PSI2NiIgcng9IjEwIiBzdHJva2Utd2lkdGg9IjEuNCIgc3R5bGU9ImZpbGw6IzA2NGUzYjtzdHJva2U6IzA0Nzg1NyIvPjx0ZXh0IHg9IjM2IiB5PSIxNTUiIHN0eWxlPSJmb250OiA3MDAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNmVlN2I3OyBmb250LXNpemU6MTJweCI+UGVyLXJlcG8gaW1tdXRhYmlsaXR5PC90ZXh0Pjx0ZXh0IHg9IjM2IiB5PSIxNzUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4Ij5pbW11dGFibGUtcmVwb3NpdG9yeSBzZXR0aW5nPC90ZXh0PjxyZWN0IHg9IjI5NiIgeT0iMTI4IiB3aWR0aD0iMjU2IiBoZWlnaHQ9IjY2IiByeD0iMTAiIHN0cm9rZS13aWR0aD0iMS40IiBzdHlsZT0iZmlsbDojMDY0ZTNiO3N0cm9rZTojMDQ3ODU3Ii8+PHRleHQgeD0iMzEyIiB5PSIxNTUiIHN0eWxlPSJmb250OiA3MDAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNmVlN2I3OyBmb250LXNpemU6MTJweCI+VnVsbmVyYWJpbGl0eSBzY2FubmluZzwvdGV4dD48dGV4dCB4PSIzMTIiIHk9IjE3NSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjgiPk9DSSBWdWxuZXJhYmlsaXR5IFNjYW5uaW5nPC90ZXh0PjxyZWN0IHg9IjU3MiIgeT0iMTI4IiB3aWR0aD0iMjU2IiBoZWlnaHQ9IjY2IiByeD0iMTAiIHN0cm9rZS13aWR0aD0iMS40IiBzdHlsZT0iZmlsbDojMDY0ZTNiO3N0cm9rZTojMDQ3ODU3Ii8+PHRleHQgeD0iNTg4IiB5PSIxNTUiIHN0eWxlPSJmb250OiA3MDAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNmVlN2I3OyBmb250LXNpemU6MTJweCI+SW1hZ2UgcmV0ZW50aW9uIHBvbGljaWVzPC90ZXh0Pjx0ZXh0IHg9IjU4OCIgeT0iMTc1IiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiOCI+cmVnaW9uIGRlZmF1bHQgwrcgcGVyLXJlcG8gY3VzdG9tPC90ZXh0Pgo8L3N2Zz4=)

OCI Container Registry features, organized around your tenancy and compartments.

#### Limitations

Where ECR and OCI Container Registry stay different

* **Lifecycle rules behave differently: retention is configured separately.** ECR's per-repository lifecycle rule has no direct analog; OCIR applies a region-wide retention policy by default that you can override for specific repositories.
* **ECR enhanced scanning is not supported.** OCI Vulnerability Scanning replaces it, with its own coverage.
* **ECR cross-region replication is not translated.** OCIR replication is a separate feature that you configure yourself; the default configuration does not set it up.

#### Other considerations

Plan image delivery, credentials, and storage costs for the target registry.

* **Push images from your build pipeline.** The build creates one tenancy-namespaced OCI repository per ECR repository. Point your pipeline at `<region>.ocir.io` and push there yourself; image traffic does not go through Tensor9.
* **Pull identity moves to OCI IAM.** A workload pulls with an auth token or an instance or workload principal in the tenancy, instead of its AWS IAM identity. Set up that credential on OCI.
* **Repositories live under your tenancy namespace and compartments.** Oracle operates the registry, and the compartment placement that scopes access and billing is set on OCI rather than inherited from AWS.
* **Image storage is billed to the tenancy.** OCIR bills stored image data under your tenancy, retention applies region-wide by default, and cross-region copy is configured separately when a multi-region estate needs it.

## On Private Kubernetes

### Harbor Registry

| Operation | Area | Support | Depth | Notes |
| - | - | - | - | - |
| Registry authentication | Auth | Supported | Common | in-cluster imagePullSecret; Harbor also supports robot accounts |
| Reference rewrite | Image path | Supported | Common | every consumer's ECR image ref is rewritten to the in-cluster host; the imagePullSecret is injected and the ECR auth helper dropped |
| docker push / pull | Image path | Supported | Common | byte-identical OCI Distribution v2; the host changes to registry.\<ns>.svc |
| Lifecycle policy mapping | Lifecycle | Partial | Most usage | Harbor tag-retention is per-repository, the closest in-cluster analog to ECR lifecycle rules |
| Image load (bootstrap) | Migration | Supported | Common | The Cloud Adapter deployment loads images before workloads pull them. Images are identified by content, so repeating the load does not duplicate them. |
| Cross-region replication | Replication | Out of scope | Full surface | an in-cluster registry has no cross-region replica; the pull-through cache to ECR is deliberately not used, so there is no outbound AWS dependency |
| Repository provisioning | Repositories | Supported | Common | the registry is deployed in-cluster and the ECR repository set becomes its repositories/namespaces (N to N) |
| Scan-on-push findings | Scanning | Partial | Most usage | Harbor ships a built-in Trivy integration (scan-on-push) |

#### How it works

On AWS your build pushes container images to **Amazon ECR** and your workloads pull from it. When the target is your own **Kubernetes cluster**, the registry runs inside the cluster: an open-source registry you operate, with no cloud registry service behind it. Harbor is the recommended registry; Zot is a smaller alternative; Distribution provides basic image storage and delivery. At the build, Tensor9 provisions the registry, loads your images into it through the Cloud Adapter deployment, and rewrites every image reference to the in-cluster host; afterward your workloads pull directly from it.

The image itself never changes. ECR and the in-cluster registry both speak the **OCI Distribution v2** protocol, so your image manifest, its layer blobs, and their content digests are byte-identical; docker and containerd are untouched. The one thing rewritten at the build is the registry address: your ECR host becomes `registry.<ns>.svc`. You operate the registry and configure its policies.

This mapping provisions a target registry and updates image references. Docker and containerd use the target registry's own protocol and credentials. It does not provide the AWS ECR management or authorization-token API: an application that calls ECR directly, including `GetAuthorizationToken`, needs a separate integration.

![Before: on AWS your build pushes images to Amazon ECR and your workloads pull from it. After: on the target cloud the same docker push and pull reach in-cluster registry, provisioned at the build. Only the registry address is rewritten; the image is unchanged and Tensor9 is not in the pull path.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMTg0IiB2aWV3Qm94PSIwIDAgODM2IDE4NCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJCZWZvcmU6IG9uIEFXUyB5b3VyIGJ1aWxkIHB1c2hlcyBpbWFnZXMgdG8gQW1hem9uIEVDUiBhbmQgeW91ciB3b3JrbG9hZHMgcHVsbCBmcm9tIGl0LiBBZnRlcjogb24gdGhlIHRhcmdldCBjbG91ZCB0aGUgc2FtZSBkb2NrZXIgcHVzaCBhbmQgcHVsbCByZWFjaCBpbi1jbHVzdGVyIHJlZ2lzdHJ5LCBwcm92aXNpb25lZCBhdCB0aGUgYnVpbGQuIE9ubHkgdGhlIHJlZ2lzdHJ5IGFkZHJlc3MgaXMgcmV3cml0dGVuOyB0aGUgaW1hZ2UgaXMgdW5jaGFuZ2VkIGFuZCBUZW5zb3I5IGlzIG5vdCBpbiB0aGUgcHVsbCBwYXRoLiI+PHN0eWxlPnRleHR7Zm9udC1mYW1pbHk6SW50ZXIsLWFwcGxlLXN5c3RlbSxCbGlua01hY1N5c3RlbUZvbnQsJ1NlZ29lIFVJJyxSb2JvdG8sJ0hlbHZldGljYSBOZXVlJyxBcmlhbCxzYW5zLXNlcmlmO2ZpbGw6IzMzNDE1NX08L3N0eWxlPgo8ZGVmcz48bWFya2VyIGlkPSJlY3Jody1pbmNsdXN0ZXIiIHZpZXdCb3g9IjAgMCAxMCAxMCIgcmVmWD0iOCIgcmVmWT0iNSIgbWFya2VyV2lkdGg9IjciIG1hcmtlckhlaWdodD0iNyIgb3JpZW50PSJhdXRvLXN0YXJ0LXJldmVyc2UiPjxwYXRoIGQ9Ik0wLDAgTDEwLDUgTDAsMTAgeiIgc3R5bGU9ImZpbGw6Izk0YTNiOCIvPjwvbWFya2VyPjwvZGVmcz4KPHJlY3QgeD0iMTYiIHk9IjQwIiB3aWR0aD0iMzU4IiBoZWlnaHQ9IjEyMCIgcng9IjE0IiBzdHJva2Utd2lkdGg9IjEuNCIgc3Ryb2tlLWRhc2hhcnJheT0iNSA1IiBzdHlsZT0iZmlsbDojZjhmYWZjO3N0cm9rZTojY2JkNWUxIi8+Cjx0ZXh0IHg9IjMwIiB5PSI2MCIgc3R5bGU9ImZvbnQ6IDcwMCAxMHB4IEludGVyLCBzYW5zLXNlcmlmOyBsZXR0ZXItc3BhY2luZzogMS4zcHg7IGZpbGw6ICM5NGEzYjg7IGZpbGw6IzY0NzQ4YiI+T04gQVdTIFRPREFZPC90ZXh0Pgo8cmVjdCB4PSIzMCIgeT0iNzgiIHdpZHRoPSIxMTgiIGhlaWdodD0iNjAiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0eWxlPSJmaWxsOiNmZmZmZmY7c3Ryb2tlOiNjYmQ1ZTEiLz4KPHRleHQgeD0iODkiIHk9IjEwNCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwZjE3MmE7IGZvbnQtc2l6ZToxMnB4Ij5idWlsZCAvIHBvZHM8L3RleHQ+Cjx0ZXh0IHg9Ijg5IiB5PSIxMjIiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiIj5kb2NrZXIgcHVzaCAvIHB1bGw8L3RleHQ+CjxsaW5lIHgxPSIxNDgiIHkxPSIxMDgiIHgyPSIyMDYiIHkyPSIxMDgiIHN0cm9rZS13aWR0aD0iMiIgbWFya2VyLWVuZD0idXJsKCNlY3Jody1pbmNsdXN0ZXIpIiBzdHlsZT0ic3Ryb2tlOiM5NGEzYjgiLz4KPHJlY3QgeD0iMjEwIiB5PSI3OCIgd2lkdGg9IjE1MCIgaGVpZ2h0PSI2MCIgcng9IjExIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6I2ZmZmZmZjtzdHJva2U6I2NiZDVlMSIvPgo8dGV4dCB4PSIyODUiIHk9IjEwNCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwZjE3MmE7IGZvbnQtc2l6ZToxMnB4Ij5BbWF6b24gRUNSPC90ZXh0Pgo8dGV4dCB4PSIyODUiIHk9IjEyMiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGIiPkFXUy1tYW5hZ2VkPC90ZXh0Pgo8dGV4dCB4PSI0MTgiIHk9IjMwIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTAuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMDQ3ODU3OyBmb250LXdlaWdodDo3MDAiPnNldCB1cCBhdCB0aGUgYnVpbGQ8L3RleHQ+CjxyZWN0IHg9IjQ2MiIgeT0iNDAiIHdpZHRoPSIzNjIiIGhlaWdodD0iMTIwIiByeD0iMTQiIHN0cm9rZS13aWR0aD0iMS40IiBzdHJva2UtZGFzaGFycmF5PSI1IDUiIHN0eWxlPSJmaWxsOiNmOGZhZmM7c3Ryb2tlOiNjYmQ1ZTEiLz4KPHRleHQgeD0iNDc2IiB5PSI2MCIgc3R5bGU9ImZvbnQ6IDcwMCAxMHB4IEludGVyLCBzYW5zLXNlcmlmOyBsZXR0ZXItc3BhY2luZzogMS4zcHg7IGZpbGw6ICM5NGEzYjg7IGZpbGw6IzA0Nzg1NyI+SU4gS1VCRVJORVRFUyBDTFVTVEVSPC90ZXh0Pgo8cmVjdCB4PSI0NzYiIHk9Ijc4IiB3aWR0aD0iMTA0IiBoZWlnaHQ9IjYwIiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojZmZmZmZmO3N0cm9rZTojY2JkNWUxIi8+Cjx0ZXh0IHg9IjUyOCIgeT0iMTA0IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzBmMTcyYTsgZm9udC1zaXplOjEycHgiPmJ1aWxkIC8gcG9kczwvdGV4dD4KPHRleHQgeD0iNTI4IiB5PSIxMjIiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2MDAgMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzA0Nzg1NyI+c2FtZSBjb21tYW5kczwvdGV4dD4KPGxpbmUgeDE9IjU4MCIgeTE9IjEwOCIgeDI9IjYxNiIgeTI9IjEwOCIgc3Ryb2tlLXdpZHRoPSIyIiBtYXJrZXItZW5kPSJ1cmwoI2Vjcmh3LWluY2x1c3RlcikiIHN0eWxlPSJzdHJva2U6Izk0YTNiOCIvPgo8cmVjdCB4PSI2MjAiIHk9Ijc0IiB3aWR0aD0iMTg4IiBoZWlnaHQ9IjY4IiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS43IiBzdHlsZT0iZmlsbDojZWNmZGY1O3N0cm9rZTojMDQ3ODU3Ii8+Cjx0ZXh0IHg9IjcxNCIgeT0iOTkiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA3MDAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMDQ3ODU3OyBmb250LXNpemU6MTEuNXB4Ij5pbi1jbHVzdGVyIHJlZ2lzdHJ5PC90ZXh0Pgo8dGV4dCB4PSI3MTQiIHk9IjExNSIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICM2NDc0OGIiPnJlZ2lzdHJ5LiZsdDtucyZndDsuc3ZjPC90ZXh0Pgo8dGV4dCB4PSI3MTQiIHk9IjEzMSIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzA0Nzg1NyI+eW91IG9wZXJhdGUgaXQsIGluLWNsdXN0ZXI8L3RleHQ+Cjx0ZXh0IHg9IjY0MyIgeT0iMTc2IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTAuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMDQ3ODU3OyBmb250LXdlaWdodDo3MDAiPlRlbnNvcjkgaXMgbm90IGluIHRoZSBwdWxsIHBhdGg8L3RleHQ+Cjwvc3ZnPg==)

![Before: on AWS your build pushes images to Amazon ECR and your workloads pull from it. After: on the target cloud the same docker push and pull reach in-cluster registry, provisioned at the build. Only the registry address is rewritten; the image is unchanged and Tensor9 is not in the pull path.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMTg0IiB2aWV3Qm94PSIwIDAgODM2IDE4NCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJCZWZvcmU6IG9uIEFXUyB5b3VyIGJ1aWxkIHB1c2hlcyBpbWFnZXMgdG8gQW1hem9uIEVDUiBhbmQgeW91ciB3b3JrbG9hZHMgcHVsbCBmcm9tIGl0LiBBZnRlcjogb24gdGhlIHRhcmdldCBjbG91ZCB0aGUgc2FtZSBkb2NrZXIgcHVzaCBhbmQgcHVsbCByZWFjaCBpbi1jbHVzdGVyIHJlZ2lzdHJ5LCBwcm92aXNpb25lZCBhdCB0aGUgYnVpbGQuIE9ubHkgdGhlIHJlZ2lzdHJ5IGFkZHJlc3MgaXMgcmV3cml0dGVuOyB0aGUgaW1hZ2UgaXMgdW5jaGFuZ2VkIGFuZCBUZW5zb3I5IGlzIG5vdCBpbiB0aGUgcHVsbCBwYXRoLiI+PHN0eWxlPnRleHR7Zm9udC1mYW1pbHk6SW50ZXIsLWFwcGxlLXN5c3RlbSxCbGlua01hY1N5c3RlbUZvbnQsJ1NlZ29lIFVJJyxSb2JvdG8sJ0hlbHZldGljYSBOZXVlJyxBcmlhbCxzYW5zLXNlcmlmO2ZpbGw6I2NiZDVlMX08L3N0eWxlPgo8ZGVmcz48bWFya2VyIGlkPSJlY3Jody1pbmNsdXN0ZXIiIHZpZXdCb3g9IjAgMCAxMCAxMCIgcmVmWD0iOCIgcmVmWT0iNSIgbWFya2VyV2lkdGg9IjciIG1hcmtlckhlaWdodD0iNyIgb3JpZW50PSJhdXRvLXN0YXJ0LXJldmVyc2UiPjxwYXRoIGQ9Ik0wLDAgTDEwLDUgTDAsMTAgeiIgc3R5bGU9ImZpbGw6IzY0NzQ4YiIvPjwvbWFya2VyPjwvZGVmcz4KPHJlY3QgeD0iMTYiIHk9IjQwIiB3aWR0aD0iMzU4IiBoZWlnaHQ9IjEyMCIgcng9IjE0IiBzdHJva2Utd2lkdGg9IjEuNCIgc3Ryb2tlLWRhc2hhcnJheT0iNSA1IiBzdHlsZT0iZmlsbDojMGYxNzJhO3N0cm9rZTojNDc1NTY5Ii8+Cjx0ZXh0IHg9IjMwIiB5PSI2MCIgc3R5bGU9ImZvbnQ6IDcwMCAxMHB4IEludGVyLCBzYW5zLXNlcmlmOyBsZXR0ZXItc3BhY2luZzogMS4zcHg7IGZpbGw6ICM2NDc0OGI7IGZpbGw6Izk0YTNiOCI+T04gQVdTIFRPREFZPC90ZXh0Pgo8cmVjdCB4PSIzMCIgeT0iNzgiIHdpZHRoPSIxMTgiIGhlaWdodD0iNjAiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0eWxlPSJmaWxsOiMxZTI5M2I7c3Ryb2tlOiM0NzU1NjkiLz4KPHRleHQgeD0iODkiIHk9IjEwNCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICNmMWY1Zjk7IGZvbnQtc2l6ZToxMnB4Ij5idWlsZCAvIHBvZHM8L3RleHQ+Cjx0ZXh0IHg9Ijg5IiB5PSIxMjIiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4Ij5kb2NrZXIgcHVzaCAvIHB1bGw8L3RleHQ+CjxsaW5lIHgxPSIxNDgiIHkxPSIxMDgiIHgyPSIyMDYiIHkyPSIxMDgiIHN0cm9rZS13aWR0aD0iMiIgbWFya2VyLWVuZD0idXJsKCNlY3Jody1pbmNsdXN0ZXIpIiBzdHlsZT0ic3Ryb2tlOiM2NDc0OGIiLz4KPHJlY3QgeD0iMjEwIiB5PSI3OCIgd2lkdGg9IjE1MCIgaGVpZ2h0PSI2MCIgcng9IjExIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6IzFlMjkzYjtzdHJva2U6IzQ3NTU2OSIvPgo8dGV4dCB4PSIyODUiIHk9IjEwNCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICNmMWY1Zjk7IGZvbnQtc2l6ZToxMnB4Ij5BbWF6b24gRUNSPC90ZXh0Pgo8dGV4dCB4PSIyODUiIHk9IjEyMiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjgiPkFXUy1tYW5hZ2VkPC90ZXh0Pgo8dGV4dCB4PSI0MTgiIHk9IjMwIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTAuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNmVlN2I3OyBmb250LXdlaWdodDo3MDAiPnNldCB1cCBhdCB0aGUgYnVpbGQ8L3RleHQ+CjxyZWN0IHg9IjQ2MiIgeT0iNDAiIHdpZHRoPSIzNjIiIGhlaWdodD0iMTIwIiByeD0iMTQiIHN0cm9rZS13aWR0aD0iMS40IiBzdHJva2UtZGFzaGFycmF5PSI1IDUiIHN0eWxlPSJmaWxsOiMwZjE3MmE7c3Ryb2tlOiM0NzU1NjkiLz4KPHRleHQgeD0iNDc2IiB5PSI2MCIgc3R5bGU9ImZvbnQ6IDcwMCAxMHB4IEludGVyLCBzYW5zLXNlcmlmOyBsZXR0ZXItc3BhY2luZzogMS4zcHg7IGZpbGw6ICM2NDc0OGI7IGZpbGw6IzZlZTdiNyI+SU4gS1VCRVJORVRFUyBDTFVTVEVSPC90ZXh0Pgo8cmVjdCB4PSI0NzYiIHk9Ijc4IiB3aWR0aD0iMTA0IiBoZWlnaHQ9IjYwIiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojMWUyOTNiO3N0cm9rZTojNDc1NTY5Ii8+Cjx0ZXh0IHg9IjUyOCIgeT0iMTA0IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogI2YxZjVmOTsgZm9udC1zaXplOjEycHgiPmJ1aWxkIC8gcG9kczwvdGV4dD4KPHRleHQgeD0iNTI4IiB5PSIxMjIiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2MDAgMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzZlZTdiNyI+c2FtZSBjb21tYW5kczwvdGV4dD4KPGxpbmUgeDE9IjU4MCIgeTE9IjEwOCIgeDI9IjYxNiIgeTI9IjEwOCIgc3Ryb2tlLXdpZHRoPSIyIiBtYXJrZXItZW5kPSJ1cmwoI2Vjcmh3LWluY2x1c3RlcikiIHN0eWxlPSJzdHJva2U6IzY0NzQ4YiIvPgo8cmVjdCB4PSI2MjAiIHk9Ijc0IiB3aWR0aD0iMTg4IiBoZWlnaHQ9IjY4IiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS43IiBzdHlsZT0iZmlsbDojMDY0ZTNiO3N0cm9rZTojNmVlN2I3Ii8+Cjx0ZXh0IHg9IjcxNCIgeT0iOTkiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA3MDAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNmVlN2I3OyBmb250LXNpemU6MTEuNXB4Ij5pbi1jbHVzdGVyIHJlZ2lzdHJ5PC90ZXh0Pgo8dGV4dCB4PSI3MTQiIHk9IjExNSIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICM5NGEzYjgiPnJlZ2lzdHJ5LiZsdDtucyZndDsuc3ZjPC90ZXh0Pgo8dGV4dCB4PSI3MTQiIHk9IjEzMSIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzZlZTdiNyI+eW91IG9wZXJhdGUgaXQsIGluLWNsdXN0ZXI8L3RleHQ+Cjx0ZXh0IHg9IjY0MyIgeT0iMTc2IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTAuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNmVlN2I3OyBmb250LXdlaWdodDo3MDAiPlRlbnNvcjkgaXMgbm90IGluIHRoZSBwdWxsIHBhdGg8L3RleHQ+Cjwvc3ZnPg==)

Your images are loaded into an in-cluster registry through the Cloud Adapter deployment at the build; afterward your workloads pull from it directly and the image is unchanged.

#### Registry features and operation

You operate the registry and configure the features of the software you choose. The registry is deployed empty : your images are loaded into it through the Cloud Adapter deployment's image delivery service before any workload pulls, and there is deliberately **no pull-through cache** back to ECR, which removes the outbound AWS dependency entirely.

**Harbor**, the recommended registry, ships built-in Trivy scan-on-push, robot accounts, per-repository retention, and immutable-tag rules, the closest match to ECR's registry-management features. **Zot** is lightweight and OCI-native, with vulnerability (CVE) search available through an optional extension. **Distribution** is the bare reference registry: it stores and delivers images and can garbage-collect unused layers, but has no scanning or tag controls. Whichever you run, your ECR repositories map one-to-one to the registry's repositories, and a workload pulls with an injected `imagePullSecret`; Harbor's robot accounts provide the richer, scoped path.

![In-cluster registry model](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjE2IiB2aWV3Qm94PSIwIDAgODM2IDIxNiIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJJbi1jbHVzdGVyIHJlZ2lzdHJ5IG1vZGVsIj48c3R5bGU+dGV4dHtmb250LWZhbWlseTpJbnRlciwtYXBwbGUtc3lzdGVtLEJsaW5rTWFjU3lzdGVtRm9udCwnU2Vnb2UgVUknLFJvYm90bywnSGVsdmV0aWNhIE5ldWUnLEFyaWFsLHNhbnMtc2VyaWY7ZmlsbDojMzM0MTU1fTwvc3R5bGU+Cjx0ZXh0IHg9IjIwIiB5PSIyNiIgc3R5bGU9ImZvbnQ6IDcwMCAxMHB4IEludGVyLCBzYW5zLXNlcmlmOyBsZXR0ZXItc3BhY2luZzogMS4zcHg7IGZpbGw6ICM5NGEzYjg7IGZpbGw6IzA0Nzg1NyI+SW4tY2x1c3RlciByZWdpc3RyeSBtb2RlbDwvdGV4dD4KPHJlY3QgeD0iMjAiIHk9IjQ0IiB3aWR0aD0iMjU2IiBoZWlnaHQ9IjY2IiByeD0iMTAiIHN0cm9rZS13aWR0aD0iMS40IiBzdHlsZT0iZmlsbDojZWNmZGY1O3N0cm9rZTojYTdmM2QwIi8+PHRleHQgeD0iMzYiIHk9IjcxIiBzdHlsZT0iZm9udDogNzAwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzA0Nzg1NzsgZm9udC1zaXplOjEycHgiPlNlbGYtbWFuYWdlZDwvdGV4dD48dGV4dCB4PSIzNiIgeT0iOTEiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiIj55b3Ugb3BlcmF0ZSB0aGUgcmVnaXN0cnk8L3RleHQ+PHJlY3QgeD0iMjk2IiB5PSI0NCIgd2lkdGg9IjI1NiIgaGVpZ2h0PSI2NiIgcng9IjEwIiBzdHJva2Utd2lkdGg9IjEuNCIgc3R5bGU9ImZpbGw6I2VjZmRmNTtzdHJva2U6I2E3ZjNkMCIvPjx0ZXh0IHg9IjMxMiIgeT0iNzEiIHN0eWxlPSJmb250OiA3MDAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMDQ3ODU3OyBmb250LXNpemU6MTJweCI+RGVwbG95ZWQgZW1wdHk8L3RleHQ+PHRleHQgeD0iMzEyIiB5PSI5MSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGIiPmltYWdlcyBsb2FkZWQgdmlhIHRoZSBhcHBsaWFuY2U8L3RleHQ+PHJlY3QgeD0iNTcyIiB5PSI0NCIgd2lkdGg9IjI1NiIgaGVpZ2h0PSI2NiIgcng9IjEwIiBzdHJva2Utd2lkdGg9IjEuNCIgc3R5bGU9ImZpbGw6I2VjZmRmNTtzdHJva2U6I2E3ZjNkMCIvPjx0ZXh0IHg9IjU4OCIgeT0iNzEiIHN0eWxlPSJmb250OiA3MDAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMDQ3ODU3OyBmb250LXNpemU6MTJweCI+SGFyYm9yIMK3IHJlY29tbWVuZGVkPC90ZXh0Pjx0ZXh0IHg9IjU4OCIgeT0iOTEiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiIj5Ucml2eSBzY2FuIMK3IHJvYm90IGFjY291bnRzPC90ZXh0PjxyZWN0IHg9IjIwIiB5PSIxMjgiIHdpZHRoPSIyNTYiIGhlaWdodD0iNjYiIHJ4PSIxMCIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0eWxlPSJmaWxsOiNlY2ZkZjU7c3Ryb2tlOiNhN2YzZDAiLz48dGV4dCB4PSIzNiIgeT0iMTU1IiBzdHlsZT0iZm9udDogNzAwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzA0Nzg1NzsgZm9udC1zaXplOjEycHgiPlpvdDwvdGV4dD48dGV4dCB4PSIzNiIgeT0iMTc1IiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YiI+bGlnaHR3ZWlnaHQsIE9DSS1uYXRpdmU8L3RleHQ+PHJlY3QgeD0iMjk2IiB5PSIxMjgiIHdpZHRoPSIyNTYiIGhlaWdodD0iNjYiIHJ4PSIxMCIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0eWxlPSJmaWxsOiNlY2ZkZjU7c3Ryb2tlOiNhN2YzZDAiLz48dGV4dCB4PSIzMTIiIHk9IjE1NSIgc3R5bGU9ImZvbnQ6IDcwMCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwNDc4NTc7IGZvbnQtc2l6ZToxMnB4Ij5EaXN0cmlidXRpb248L3RleHQ+PHRleHQgeD0iMzEyIiB5PSIxNzUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiIj5iYXJlIHJlZ2lzdHJ5LCBsYXllciBjbGVhbnVwPC90ZXh0PjxyZWN0IHg9IjU3MiIgeT0iMTI4IiB3aWR0aD0iMjU2IiBoZWlnaHQ9IjY2IiByeD0iMTAiIHN0cm9rZS13aWR0aD0iMS40IiBzdHlsZT0iZmlsbDojZWNmZGY1O3N0cm9rZTojYTdmM2QwIi8+PHRleHQgeD0iNTg4IiB5PSIxNTUiIHN0eWxlPSJmb250OiA3MDAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMDQ3ODU3OyBmb250LXNpemU6MTJweCI+UHVsbCBpZGVudGl0eTwvdGV4dD48dGV4dCB4PSI1ODgiIHk9IjE3NSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGIiPmltYWdlUHVsbFNlY3JldCAvIHJvYm90IGFjY291bnRzPC90ZXh0Pgo8L3N2Zz4=)

![In-cluster registry model](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjE2IiB2aWV3Qm94PSIwIDAgODM2IDIxNiIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJJbi1jbHVzdGVyIHJlZ2lzdHJ5IG1vZGVsIj48c3R5bGU+dGV4dHtmb250LWZhbWlseTpJbnRlciwtYXBwbGUtc3lzdGVtLEJsaW5rTWFjU3lzdGVtRm9udCwnU2Vnb2UgVUknLFJvYm90bywnSGVsdmV0aWNhIE5ldWUnLEFyaWFsLHNhbnMtc2VyaWY7ZmlsbDojY2JkNWUxfTwvc3R5bGU+Cjx0ZXh0IHg9IjIwIiB5PSIyNiIgc3R5bGU9ImZvbnQ6IDcwMCAxMHB4IEludGVyLCBzYW5zLXNlcmlmOyBsZXR0ZXItc3BhY2luZzogMS4zcHg7IGZpbGw6ICM2NDc0OGI7IGZpbGw6IzZlZTdiNyI+SW4tY2x1c3RlciByZWdpc3RyeSBtb2RlbDwvdGV4dD4KPHJlY3QgeD0iMjAiIHk9IjQ0IiB3aWR0aD0iMjU2IiBoZWlnaHQ9IjY2IiByeD0iMTAiIHN0cm9rZS13aWR0aD0iMS40IiBzdHlsZT0iZmlsbDojMDY0ZTNiO3N0cm9rZTojMDQ3ODU3Ii8+PHRleHQgeD0iMzYiIHk9IjcxIiBzdHlsZT0iZm9udDogNzAwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzZlZTdiNzsgZm9udC1zaXplOjEycHgiPlNlbGYtbWFuYWdlZDwvdGV4dD48dGV4dCB4PSIzNiIgeT0iOTEiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4Ij55b3Ugb3BlcmF0ZSB0aGUgcmVnaXN0cnk8L3RleHQ+PHJlY3QgeD0iMjk2IiB5PSI0NCIgd2lkdGg9IjI1NiIgaGVpZ2h0PSI2NiIgcng9IjEwIiBzdHJva2Utd2lkdGg9IjEuNCIgc3R5bGU9ImZpbGw6IzA2NGUzYjtzdHJva2U6IzA0Nzg1NyIvPjx0ZXh0IHg9IjMxMiIgeT0iNzEiIHN0eWxlPSJmb250OiA3MDAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNmVlN2I3OyBmb250LXNpemU6MTJweCI+RGVwbG95ZWQgZW1wdHk8L3RleHQ+PHRleHQgeD0iMzEyIiB5PSI5MSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjgiPmltYWdlcyBsb2FkZWQgdmlhIHRoZSBhcHBsaWFuY2U8L3RleHQ+PHJlY3QgeD0iNTcyIiB5PSI0NCIgd2lkdGg9IjI1NiIgaGVpZ2h0PSI2NiIgcng9IjEwIiBzdHJva2Utd2lkdGg9IjEuNCIgc3R5bGU9ImZpbGw6IzA2NGUzYjtzdHJva2U6IzA0Nzg1NyIvPjx0ZXh0IHg9IjU4OCIgeT0iNzEiIHN0eWxlPSJmb250OiA3MDAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNmVlN2I3OyBmb250LXNpemU6MTJweCI+SGFyYm9yIMK3IHJlY29tbWVuZGVkPC90ZXh0Pjx0ZXh0IHg9IjU4OCIgeT0iOTEiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4Ij5Ucml2eSBzY2FuIMK3IHJvYm90IGFjY291bnRzPC90ZXh0PjxyZWN0IHg9IjIwIiB5PSIxMjgiIHdpZHRoPSIyNTYiIGhlaWdodD0iNjYiIHJ4PSIxMCIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0eWxlPSJmaWxsOiMwNjRlM2I7c3Ryb2tlOiMwNDc4NTciLz48dGV4dCB4PSIzNiIgeT0iMTU1IiBzdHlsZT0iZm9udDogNzAwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzZlZTdiNzsgZm9udC1zaXplOjEycHgiPlpvdDwvdGV4dD48dGV4dCB4PSIzNiIgeT0iMTc1IiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiOCI+bGlnaHR3ZWlnaHQsIE9DSS1uYXRpdmU8L3RleHQ+PHJlY3QgeD0iMjk2IiB5PSIxMjgiIHdpZHRoPSIyNTYiIGhlaWdodD0iNjYiIHJ4PSIxMCIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0eWxlPSJmaWxsOiMwNjRlM2I7c3Ryb2tlOiMwNDc4NTciLz48dGV4dCB4PSIzMTIiIHk9IjE1NSIgc3R5bGU9ImZvbnQ6IDcwMCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2ZWU3Yjc7IGZvbnQtc2l6ZToxMnB4Ij5EaXN0cmlidXRpb248L3RleHQ+PHRleHQgeD0iMzEyIiB5PSIxNzUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4Ij5iYXJlIHJlZ2lzdHJ5LCBsYXllciBjbGVhbnVwPC90ZXh0PjxyZWN0IHg9IjU3MiIgeT0iMTI4IiB3aWR0aD0iMjU2IiBoZWlnaHQ9IjY2IiByeD0iMTAiIHN0cm9rZS13aWR0aD0iMS40IiBzdHlsZT0iZmlsbDojMDY0ZTNiO3N0cm9rZTojMDQ3ODU3Ii8+PHRleHQgeD0iNTg4IiB5PSIxNTUiIHN0eWxlPSJmb250OiA3MDAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNmVlN2I3OyBmb250LXNpemU6MTJweCI+UHVsbCBpZGVudGl0eTwvdGV4dD48dGV4dCB4PSI1ODgiIHk9IjE3NSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjgiPmltYWdlUHVsbFNlY3JldCAvIHJvYm90IGFjY291bnRzPC90ZXh0Pgo8L3N2Zz4=)

Choose the registry features your application needs: Harbor, Zot, or Distribution.

#### Limitations

Where ECR and an in-cluster registry stay different

* **Pulling through to ECR is not supported.** The registry starts empty. Your images are loaded through the Cloud Adapter deployment before any workload pulls; there is deliberately no pull-through cache back to ECR.
* **Scanning, immutability and retention behave differently: they depend on the registry you run.** Harbor supports most ECR management features, Zot some of them, and Distribution, a bare registry, none of them built in.
* **Cross-region replication is not supported.** An in-cluster registry is for the cluster it runs in. Images are loaded through the Cloud Adapter deployment, not replicated across regions.

#### Other considerations

Plan image delivery, credentials, and storage costs for the target registry.

* **Images are loaded through the Cloud Adapter deployment, then pulled locally.** The registry is deployed empty and your images are loaded through the Cloud Adapter deployment before any workload pulls. There is no pull-through cache back to ECR, so the running cluster does not depend on AWS.
* **You operate the registry.** There is no cloud service behind it. Harbor, Zot or Distribution is yours to run, and its availability, upgrades and access model are your responsibility.
* **Back up the registry's persistent volume.** The registry's image layers live on a PersistentVolume in the cluster, so backup and retention of the image store are yours.
* **Budget for cluster compute and storage.** The registry uses the cluster's own compute and storage rather than a managed per-tier or per-byte charge. Scanning, immutability and retention depend on which registry you chose.

## On Scaleway

### Scaleway Container Registry

| Operation | Area | Support | Depth | Notes |
| - | - | - | - | - |
| Pushing and pulling images | Data plane | Supported | Common | Scaleway Container Registry speaks the Docker Registry v2 protocol, so your build and your cluster push and pull unchanged once they are pointed at it. |
| Cross-region replication and creation templates | Operations | Out of scope | Most usage | Scaleway Container Registry is single-region with one endpoint per account, so a replication configuration is dropped, and repository creation templates have no analog. Both are reported by the build for every ECR installation. |
| Image tag immutability | Operations | Out of scope | Most usage | A repository's image\_tag\_mutability setting is DROPPED: Scaleway Container Registry exposes no per-repository tag-immutability control. The build reports it; a pipeline that relied on immutable tags must enforce that on the pushing side. |
| Lifecycle policies | Operations | Out of scope | Most usage | ECR lifecycle rules that expire images by age or count have no counterpart on the emitted registry; image retention becomes something to manage on the Scaleway side. |
| Per-repository URLs and ARNs in terraform | References | Out of scope | Common | A repository's repository\_url, arn and registry\_id have no equivalent, because there is no per-repository resource to carry them. If your configuration interpolates one, the build STOPS -- it does not emit a URL that would resolve to the wrong place. Applications receive their image path through the Cloud Adapter deployment rather than through terraform interpolation. |
| Registry-level references | References | Supported | Common | The registry's own name and id do resolve, so configuration pointing at the registry rather than at one repository inside it keeps working. |
| Image scanning | Security | Out of scope | Most usage | ECR's scan-on-push configuration has no counterpart in this mapping. |
| Repository and registry policies | Security | Out of scope | Most usage | ECR repository and registry IAM policies are REMOVED: access to the Scaleway registry is the account's API credential and the cluster's pull secret, not a per-repository policy document. The build reports each policy it removes. |
| Several repositories | Topology | Partial | Common | THE HEADLINE DIFFERENCE. AWS ECR is per-repository -- every repository is its own registry with its own URL. Scaleway has exactly ONE Container Registry per account, so all of your repositories COLLAPSE into a single registry and your images become paths inside it: rg.\<region>.scw\.cloud/\<namespace>/\<repo>. Your images are all there; they are not in N separate registries. |

## Install and run

The documentation and SLAs are public. Downloading and running the Cloud Adapter binary requires an entitled customer account. Set `T9_API_KEY` as described in [Install and Authenticate](https://docs.tensor9.com/cloud-adapter-early-access/getting-started/install-and-authenticate.md), then list the adapters your account may use with this origin:

```sh theme={null}
tensor9 adapt svc list \
  -origin aws::1.0.0::ecr
```

The result is limited to directed mappings for this origin that your account is entitled to use. Use a returned backend identifier when configuring the adapter or investigating a request.

Request binary access from [hello@tensor9.com](mailto:hello@tensor9.com) if your account does not yet include this direction.

## Existing data and credentials

Selecting a backend does not copy existing data, credentials or access policies. Plan and verify migration separately before changing an application's endpoint. Do not assume an identifier, credential or encrypted value from the origin service works unchanged on the target.

## Configure, tune and debug

Start with [setup](https://docs.tensor9.com/cloud-adapter-early-access/getting-started/overview.md) and [configuration](https://docs.tensor9.com/cloud-adapter-early-access/configuration/overview.md). Use [tuning](https://docs.tensor9.com/cloud-adapter-early-access/tuning/overview.md) to understand supported request tags, [debugging](https://docs.tensor9.com/cloud-adapter-early-access/debugging/overview.md) to investigate a request, and [High Fidelity Cloud Emulators](https://docs.tensor9.com/cloud-adapter-early-access/local-testing/overview.md) to validate a bounded reproduction.

For requests that go through an entitled service adapter, use [tensor9 explain](https://docs.tensor9.com/cloud-adapter-early-access/debugging/explain.md) and [x-t9-explain](https://docs.tensor9.com/cloud-adapter-early-access/debugging/response-headers.md) to inspect the selected mapping.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.