Skip to main content
On this page

​
Coverage by target cloud

​
How the targets compare

Each row compares a capability of ECR Public with its adaptation on each target. A dash means this row is not stated for that target.

​
Infrastructure-only adaptation

​
On Google Cloud

​
Public images on Artifact Registry

Each selected ECR Public repository becomes a dedicated standard Docker repository in the target project and location. The image URL includes the location, project, repository and image path. Clients use the target registry directly at Infrastructure-only adaptation. AWS ECR Public management and authorization-token APIs, the Public Gallery and public.ecr.aws registry aliases are outside this mapping. Native push and pull do not implement AWS PutImage, layer-upload APIs or GetAuthorizationToken. No Max request adapter or additional STS operation is implied.
Anonymous readers pull from Artifact Registry; authenticated publishers write selected public repositories.Anonymous readers pull from Artifact Registry; authenticated publishers write selected public repositories.

​
Anonymous reads and authenticated publication

Grant Artifact Registry Reader to allUsers on each selected repository. Publishers authenticate with a target principal granted write access to that repository; a public reader receives no write grant. Public access is repository-scoped. Keep private ECR images in their separate repositories and never grant project-wide public access to satisfy this mapping. Organization policy must permit anonymous readers.

​
Selected images and changed references

Select the source images and tags to transfer and freeze each selected tag to its source digest. Copy supported Docker schema-2 or OCI manifests and layers without changing their bytes. A retained multi-platform index includes all its referenced platform images. Verify the destination digests; a copy that requires media-type conversion or cannot preserve a required digest fails. Update only the image references the mapping controls. External users must change their old AWS image URLs. The selected images do not include an unbounded registry history or continued replication of later AWS changes. Signatures, attestations, referrers, SBOMs and scanning history need their own transfer scope. Foreign layers fetched from external URLs are outside the initial self-contained copy guarantee. Preserving an image digest does not preserve repository identity or signature trust.

​
Operating the public registry

Google operates the registry. You own its repository permissions, publisher identity, image retention and public traffic costs. Set request quotas appropriate for anonymous clients; a quota or provider outage can interrupt new pulls. Configure Artifact Registry cleanup separately and retain releases needed for rollback. This mapping does not translate AWS repository policies or import scanning findings. Optional native scanning is a separate target configuration.

​
Limits of this mapping

  • The source AWS registry alias and ECR Public Gallery listing do not follow the image to its new URL.
  • A remote or virtual repository is not a substitute for the dedicated repository containing the selected copied images.
  • A project policy that forbids allUsers makes this public choice unavailable; a private repository is not an equivalent public result.
  • Public distribution requires reachable public HTTPS and permissions for anonymous readers. A policy that forbids that access must reject this choice, not silently produce a private registry.

​
On Azure

​
Public images on Azure Container Registry

Use a dedicated public-only Standard or Premium Azure Container Registry. Selected public repositories become distinct image paths under its azurecr.io hostname. Clients use the target registry directly at Infrastructure-only adaptation. AWS ECR Public management and authorization-token APIs, the Public Gallery and public.ecr.aws registry aliases are outside this mapping. Native push and pull do not implement AWS PutImage, layer-upload APIs or GetAuthorizationToken. No Max request adapter or additional STS operation is implied.
Anonymous readers pull from Azure Container Registry; authenticated publishers write selected public repositories.Anonymous readers pull from Azure Container Registry; authenticated publishers write selected public repositories.

​
Anonymous reads and authenticated publication

Enable anonymous pull for the public registry. Publishers use authenticated native credentials scoped to read and write their selected repository paths; public access does not grant publishing rights. Anonymous pull exposes every repository in this registry, including repositories with separate permission settings. Never reuse the private ECR registry or turn it public. Private ECR images must remain in a different registry.

​
Selected images and changed references

Select the source images and tags to transfer and freeze each selected tag to its source digest. Copy supported Docker schema-2 or OCI manifests and layers without changing their bytes. A retained multi-platform index includes all its referenced platform images. Verify the destination digests; a copy that requires media-type conversion or cannot preserve a required digest fails. Update only the image references the mapping controls. External users must change their old AWS image URLs. The selected images do not include an unbounded registry history or continued replication of later AWS changes. Signatures, attestations, referrers, SBOMs and scanning history need their own transfer scope. Foreign layers fetched from external URLs are outside the initial self-contained copy guarantee. Preserving an image digest does not preserve repository identity or signature trust.

​
Operating the public registry

Azure operates the registry. You own its SKU, public endpoint, publisher scopes, credentials and storage/egress costs. A Private Link-only or otherwise private-only endpoint cannot supply anonymous internet distribution. Configure native cleanup and any optional scanning independently. AWS repository policies, scan results and continuous replication are not imported. Retain current releases and rollback digests before deleting old content.

​
Limits of this mapping

  • Anonymous pull requires the Standard or Premium service tier; it is not a Basic-tier public option.
  • The public-access switch is registry-wide, not an anonymous exception for one selected repository.
  • Public traffic can be throttled. Network restrictions must still allow the readers this mapping is intended to serve.
  • Public distribution requires reachable public HTTPS and permissions for anonymous readers. A policy that forbids that access must reject this choice, not silently produce a private registry.

​
On OCI

​
Public images on OCI Container Registry

Create an explicitly public OCIR repository for each selected public source repository. Consumers use the target region, tenancy namespace and mapped repository path. Clients use the target registry directly at Infrastructure-only adaptation. AWS ECR Public management and authorization-token APIs, the Public Gallery and public.ecr.aws registry aliases are outside this mapping. Native push and pull do not implement AWS PutImage, layer-upload APIs or GetAuthorizationToken. No Max request adapter or additional STS operation is implied.
Anonymous readers pull from OCI Container Registry; authenticated publishers write selected public repositories.Anonymous readers pull from OCI Container Registry; authenticated publishers write selected public repositories.

​
Anonymous reads and authenticated publication

Anyone who can reach the public URL can pull the selected images without credentials. Publishers authenticate with native credentials and permissions to read and update the selected repositories. Publicity is set on each selected repository. Keep private repositories private and separate. Scope publisher policy to the selected repositories rather than granting blanket registry administration across the tenancy.

​
Selected images and changed references

Select the source images and tags to transfer and freeze each selected tag to its source digest. Copy supported Docker schema-2 or OCI manifests and layers without changing their bytes. A retained multi-platform index includes all its referenced platform images. Verify the destination digests; a copy that requires media-type conversion or cannot preserve a required digest fails. Update only the image references the mapping controls. External users must change their old AWS image URLs. The selected images do not include an unbounded registry history or continued replication of later AWS changes. Signatures, attestations, referrers, SBOMs and scanning history need their own transfer scope. Foreign layers fetched from external URLs are outside the initial self-contained copy guarantee. Preserving an image digest does not preserve repository identity or signature trust.

​
Operating the public registry

Oracle operates the regional registry. You own the public repository settings, publisher credentials, cleanup and traffic costs. Copy required release and rollback images to the selected region before directing clients there. Use OCIR retention and optional scanning as separate target controls. The mapping does not transfer AWS scanning history or repository policy semantics. Additional regional copies require an explicit image-delivery plan.

​
Limits of this mapping

  • Region and tenancy namespace are part of the image reference. Replace AWS account and registry-alias URLs with the target image reference.
  • A private service-gateway path does not replace the public URL required by external anonymous readers.
  • A selected regional copy does not establish continuous cross-region or AWS-to-OCI replication.
  • Public distribution requires reachable public HTTPS and permissions for anonymous readers. A policy that forbids that access must reject this choice, not silently produce a private registry.

​
On Private Kubernetes

​
Via Zot

​
Public images on Zot

Use a dedicated public Zot deployment with persistent image storage and a trusted public HTTPS endpoint. Keep selected repository paths explicit instead of exposing the private registry deployment. Clients use the target registry directly at Infrastructure-only adaptation. AWS ECR Public management and authorization-token APIs, the Public Gallery and public.ecr.aws registry aliases are outside this mapping. Native push and pull do not implement AWS PutImage, layer-upload APIs or GetAuthorizationToken. No Max request adapter or additional STS operation is implied.
Anonymous readers pull from Zot; authenticated publishers write selected public repositories.Anonymous readers pull from Zot; authenticated publishers write selected public repositories.

​
Anonymous reads and authenticated publication

For each selected path, grant anonymousPolicy read only. Named authenticated publishers receive read, create and update actions. Deny mutation to other users and anonymous clients; do not install a global create/update or administrator grant as a default. Keep private images in the separate private deployment. Use the configuration schema for the deployed Zot release and verify exact repository matching and more-specific path precedence before exposing the endpoint.

​
Selected images and changed references

Select the source images and tags to transfer and freeze each selected tag to its source digest. Copy supported Docker schema-2 or OCI manifests and layers without changing their bytes. A retained multi-platform index includes all its referenced platform images. Verify the destination digests; a copy that requires media-type conversion or cannot preserve a required digest fails. Update only the image references the mapping controls. External users must change their old AWS image URLs. The selected images do not include an unbounded registry history or continued replication of later AWS changes. Signatures, attestations, referrers, SBOMs and scanning history need their own transfer scope. Foreign layers fetched from external URLs are outside the initial self-contained copy guarantee. Preserving an image digest does not preserve repository identity or signature trust.

​
Operating the public registry

You operate storage capacity, backups, publisher authentication, public ingress and TLS renewal. A fresh anonymous client must pull without a cached credential or layer. Restore and credential-rotation procedures must retain the read/write boundary. Configure Zot retention independently of AWS policies. Optional native extensions do not import ECR Public scanning results or history. Retain manifests and layers referenced by current releases and rollback images.

​
Limits of this mapping

  • The public endpoint must be reachable by intended internet readers; cluster-local DNS alone is insufficient.
  • Anonymous read and authenticated publication are separate ACLs. A broad authenticated default write rule would defeat publisher isolation.
  • The mapping does not promise AWS lifecycle-policy translation, AWS scanning equivalence or continuous replication.
  • Public distribution requires reachable public HTTPS and permissions for anonymous readers. A policy that forbids that access must reject this choice, not silently produce a private registry.

​
Via Distribution

​
Public images on Distribution

Deploy a dedicated public Distribution registry and a separate Cesanta docker_auth token issuer. Both have public trusted HTTPS endpoints; the registry keeps its own persistent image storage. Clients use the target registry directly at Infrastructure-only adaptation. AWS ECR Public management and authorization-token APIs, the Public Gallery and public.ecr.aws registry aliases are outside this mapping. Native push and pull do not implement AWS PutImage, layer-upload APIs or GetAuthorizationToken. No Max request adapter or additional STS operation is implied.
Anonymous readers pull from Distribution; authenticated publishers write selected public repositories.Anonymous readers pull from Distribution; authenticated publishers write selected public repositories.

​
Anonymous reads and authenticated publication

The token issuer grants anonymous clients pull only for the exact public repositories. Authenticated publishers receive pull and push only for their assigned repositories. Requested scopes are intersected with the ordered ACL; asking for push cannot enlarge anonymous rights. Use an exact publisher/repository rule followed by the exact public-read rule and deny everything else. Keep the private registry and its signing trust separate. Do not copy example localhost, bridge-network or administrator wildcard grants into the public ACL.

​
Selected images and changed references

Select the source images and tags to transfer and freeze each selected tag to its source digest. Copy supported Docker schema-2 or OCI manifests and layers without changing their bytes. A retained multi-platform index includes all its referenced platform images. Verify the destination digests; a copy that requires media-type conversion or cannot preserve a required digest fails. Update only the image references the mapping controls. External users must change their old AWS image URLs. The selected images do not include an unbounded registry history or continued replication of later AWS changes. Signatures, attestations, referrers, SBOMs and scanning history need their own transfer scope. Foreign layers fetched from external URLs are outside the initial self-contained copy guarantee. Preserving an image digest does not preserve repository identity or signature trust.

​
Operating the public registry

You operate the registry, token issuer, TLS certificates, protected publisher credentials and token-signing trust. Use a reviewed docker_auth release and compatible Distribution image. Match issuer and audience and configure trusted signing material. Rotate keys with a bounded verification overlap; new token issuance depends on issuer availability. Public deletion is disabled by default. Retirement and garbage collection are separate operator procedures with writes stopped or read-only as required by the selected release. Back up storage, ACL configuration and signing material. AWS cleanup policies, scanning findings and automatic replication are outside this mapping.

​
Limits of this mapping

  • An anonymous bearer token is native registry access machinery, not an AWS ECR Public authorization token or an AWS identity.
  • Publisher pull/push grants do not include deletion, other repository namespaces or token-service administration.
  • Operating the separate token issuer is part of this choice. Existing valid tokens do not establish availability of future token requests.
  • Public distribution requires reachable public HTTPS and permissions for anonymous readers. A policy that forbids that access must reject this choice, not silently produce a private registry.

​
Via Harbor

​
Public images on Harbor

Deploy Harbor behind a public DNS name and trusted HTTPS endpoint. Place the selected images in a dedicated public project; repository names remain distinct within that project. Clients use the target registry directly at Infrastructure-only adaptation. AWS ECR Public management and authorization-token APIs, the Public Gallery and public.ecr.aws registry aliases are outside this mapping. Native push and pull do not implement AWS PutImage, layer-upload APIs or GetAuthorizationToken. No Max request adapter or additional STS operation is implied.
Anonymous readers pull from Harbor; authenticated publishers write selected public repositories.Anonymous readers pull from Harbor; authenticated publishers write selected public repositories.

​
Anonymous reads and authenticated publication

Anonymous clients can pull from the public project. A project robot authenticates publication with pull and push permissions. Do not give anonymous clients or publisher robots project administration or deletion permissions. Every repository placed in the public project is public. Do not flip an existing private project to public or load private ECR images into it. Keep the private registry deployment and its image population separate.

​
Selected images and changed references

Select the source images and tags to transfer and freeze each selected tag to its source digest. Copy supported Docker schema-2 or OCI manifests and layers without changing their bytes. A retained multi-platform index includes all its referenced platform images. Verify the destination digests; a copy that requires media-type conversion or cannot preserve a required digest fails. Update only the image references the mapping controls. External users must change their old AWS image URLs. The selected images do not include an unbounded registry history or continued replication of later AWS changes. Signatures, attestations, referrers, SBOMs and scanning history need their own transfer scope. Foreign layers fetched from external URLs are outside the initial self-contained copy guarantee. Preserving an image digest does not preserve repository identity or signature trust.

​
Operating the public registry

You operate Harbor, its registry storage and backing state, the public ingress and certificate renewal. Preserve robot secrets when issued, rotate them through the operator workflow and account for credential expiry. Back up configuration and stored content together and verify recovery. Harbor offers its own retention and scanning controls, which need separate configuration. This mapping does not import AWS policy rules, findings or Gallery metadata. Ensure cleanup retains the image digests used by running deployments and rollback plans.

​
Limits of this mapping

  • Private Kubernetes describes the hosting environment; anonymous internet distribution still needs a deliberately public endpoint.
  • Project publicity is broader than a single image tag; all repositories added to the public project share that exposure.
  • Native retention, scanning and replication capabilities do not imply equivalent AWS policies, results or ongoing replication.
  • Public distribution requires reachable public HTTPS and permissions for anonymous readers. A policy that forbids that access must reject this choice, not silently produce a private registry.
Service Catalog.