> ## Documentation Index
> Fetch the complete documentation index at: https://notes.kodekloud.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Image Repository Security
> This article explains how to secure container images, including naming conventions, using secure registries, and configuring Pods for private repositories.
In this lesson, you’ll learn how to secure container images by:
* Understanding image naming conventions
* Working with secure image registries
* Configuring Pods to pull from private repositories
Previously, we deployed Pods running web apps, databases, and caches. Let’s begin with a simple Pod definition that uses the official nginx image:
```yaml theme={null}
apiVersion: v1
kind: Pod
metadata:
name: nginx-pod
spec:
containers:
- name: nginx
image: nginx
```
## Understanding Image Names
Docker interprets `image: nginx` as `library/nginx` under the hood. The full naming convention is:
```text theme={null}
[registry]/[user-or-namespace]/[repository]:[tag]
```
* Omit the registry → defaults to Docker Hub (`docker.io`)
* Omit the namespace → defaults to `library` (the official account)
Specifying:
```yaml theme={null}
image: library/nginx
```
is equivalent to:
```yaml theme={null}
image: docker.io/library/nginx
```
You can also pull from other public registries. For example, Google’s registry hosts Kubernetes test images:
```yaml theme={null}
image: gcr.io/kubernetes-e2e-test-images/dnsutils
```
### Common Public Registries
| Registry | URL | Use Case |
| ------------------------ | --------- | ------------------------------- |
| Docker Hub | docker.io | Default public images |
| Google Artifact Registry | gcr.io | Google-hosted Kubernetes images |
| Quay.io | quay.io | CI/CD and enterprise images |
## Using a Private Registry
For in-house applications, you can host your own registry or use a managed solution:
| Provider | Link |
| ------------------------ | -------------------------------------------------------------------------------------------------------------------- |
| AWS ECR | [https://aws.amazon.com/ecr/](https://aws.amazon.com/ecr/) |
| Azure Container Registry | [https://azure.microsoft.com/services/container-registry/](https://azure.microsoft.com/services/container-registry/) |
| Google Artifact Registry | [https://cloud.google.com/artifact-registry](https://cloud.google.com/artifact-registry) |
To pull from a private registry, follow these steps:
1. **Authenticate locally** (for pushing and testing)
```bash theme={null}
docker login private-registry.io
# Username: registry-user
# Password: ********
# WARNING! Your password will be stored unencrypted in ~/.docker/config.json.
# Login Succeeded
```
Avoid committing `~/.docker/config.json` to version control.\
Store credentials securely (e.g., using a secrets manager).
2. **Create a Kubernetes Secret** of type `docker-registry` so worker nodes can pull the image:
```bash theme={null}
kubectl create secret docker-registry regcred \
--docker-server=private-registry.io \
--docker-username=registry-user \
--docker-password=registry-password \
--docker-email=registry-user@org.com
```
3. **Reference the Secret** in your Pod spec under `imagePullSecrets`:
```yaml theme={null}
apiVersion: v1
kind: Pod
metadata:
name: internal-app-pod
spec:
containers:
- name: internal-app
image: private-registry.io/apps/internal-app
imagePullSecrets:
- name: regcred
```
When this Pod is scheduled, the kubelet uses the Secret to authenticate and pull the private image.
***
## Links and References
* [Kubernetes Documentation](https://kubernetes.io/docs/)
* [Docker Hub](https://hub.docker.com/)
* [Terraform Registry](https://registry.terraform.io/)
* [Kubernetes Basics](https://kubernetes.io/docs/concepts/overview/what-is-kubernetes/)