# container image registry

Published articles for container image registry.

This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles.

## Publishing a Kubernetes SIG's Images to registry.k8s.io

DevFeed: [Publishing a Kubernetes SIG's Images to registry.k8s.io](<https://devfeed.tech/articles/publishing-a-kubernetes-sig-s-images-to-registry-k8s-io-31455.md>)

Original publisher: [Read original article](<https://www.kubernetes.dev/blog/2026/09/16/publishing-images-to-registry-k8s-io/>)

Author: The Kubernetes Authors

Published: 2026-09-16T18:00:00Z

Content type: tutorial

Language: en

Sources: [Kubernetes Contributors Blog](<https://devfeed.tech/sources/kubernetes-contributors-blog.md>)

Topics: [Kubernetes](<https://devfeed.tech/topics/kubernetes.md>), [container images](<https://devfeed.tech/topics/container-images.md>), [GitHub Actions](<https://devfeed.tech/topics/github-actions.md>), [CI/CD](<https://devfeed.tech/topics/cicd.md>), [Google Cloud Platform (GCP)](<https://devfeed.tech/topics/google-cloud.md>)

Tags: [ci-cd](<https://devfeed.tech/tags/ci-cd.md>), [container-image](<https://devfeed.tech/tags/container-image.md>), [container-image-registry](<https://devfeed.tech/tags/container-image-registry.md>), [container-images](<https://devfeed.tech/tags/container-images.md>), [documentation](<https://devfeed.tech/tags/documentation.md>), [github-actions](<https://devfeed.tech/tags/github-actions.md>), [google-cloud](<https://devfeed.tech/tags/google-cloud.md>), [guide](<https://devfeed.tech/tags/guide.md>), [kubernetes](<https://devfeed.tech/tags/kubernetes.md>)

### AI overview

A guide to publishing official Kubernetes SIG container images through registry.k8s.io. It explains why GHCR is unsuitable for public distribution and describes the ordered workflow involving Prow, Google Cloud Build, staging registries, and image promotion.

### Source excerpt

If you're publishing container images for a Kubernetes SIG project, you might expect the same publishing workflow used by other container registries to work. That was my assumption too. My workflow successfully published the images, but they weren't publicly available. Instead, official Kubernetes project images are distributed through registry.k8s.io , the Kubernetes project's official container image registry. No single step was hard, but the steps were spread across multiple repositories and had to happen in a particular order, something I mostly learned by tripping over them. This post is the guide I wish I had at the start. It walks through that workflow end to end using Cluster Inventory API from SIG Multicluster as an example. The same process applies to eligible Kubernetes subprojects that publish official container images. My first attempt: GHCR I first tried a common GitHub release pattern: using GitHub Actions to publish images to ghcr.io on a tag push (cluster-inventory-api#40 ). The workflow succeeded, but Kubernetes GitHub organizations keep GHCR packages private, so GHCR cannot be used for public distribution. As described in the registry.k8s.io documentation , official images take a different route: Prow (the Kubernetes project's CI/CD system) picks up a tag push and runs Google Cloud Build on Kubernetes-owned infrastructure to push the image to a staging registry, and the image promoter then copies it to registry.k8s.io. The first-time setup, step by step Besides the image-owning repository, this touches three infrastructure repositories: kubernetes/k8s.io , kubernetes/test-infra , and kubernetes/org . The pieces depend on each other like this: Before you start: decide your project details Before setting up the publishing workflow, decide a few project-specific details. These values will be reused throughout the setup when creating the staging registry, configuring image builds, and setting up image promotion: <project>, which determines the staging

## Kubernetes Changed Block Tracking API - Beta Differences

DevFeed: [Kubernetes Changed Block Tracking API - Beta Differences](<https://devfeed.tech/articles/kubernetes-changed-block-tracking-api-beta-differences-20862.md>)

Original publisher: [Read original article](<https://kubernetes.io/blog/2026/09/14/csi-changed-block-tracking-beta/>)

Author: Prasad Ghangal

Published: 2026-09-14T18:30:00Z

Content type: article

Language: en

Sources: [Kubernetes Blog](<https://devfeed.tech/sources/kubernetes-blog.md>)

Topics: [Kubernetes](<https://devfeed.tech/topics/kubernetes.md>), [API](<https://devfeed.tech/topics/api.md>), [gRPC](<https://devfeed.tech/topics/grpc.md>)

Tags: [2026](<https://devfeed.tech/tags/2026.md>), [compatibility](<https://devfeed.tech/tags/compatibility.md>), [container-image-registry](<https://devfeed.tech/tags/container-image-registry.md>), [developer](<https://devfeed.tech/tags/developer.md>), [documentation](<https://devfeed.tech/tags/documentation.md>), [kubernetes](<https://devfeed.tech/tags/kubernetes.md>), [registry](<https://devfeed.tech/tags/registry.md>), [release](<https://devfeed.tech/tags/release.md>), [snapshots](<https://devfeed.tech/tags/snapshots.md>), [storage](<https://devfeed.tech/tags/storage.md>), [streaming](<https://devfeed.tech/tags/streaming.md>), [update](<https://devfeed.tech/tags/update.md>)

### AI overview

This Kubernetes developer article explains the Beta changes to Changed Block Tracking (CBT) support for CSI drivers. The SnapshotMetadataService CRD moved from v1alpha1 to v1beta1, with no automatic conversion, and CBT remains limited to block volumes. It also outlines compatibility requirements and the steps for upgrading and trying the feature.

### Source excerpt

Changed Block Tracking (CBT) support for CSI drivers shipped as Alpha in September 2025. With the March 2026 v1.0.0 release of the external-snapshot-metadata project, the feature moved to Beta. If you aren't yet familiar with changed block tracking for storage in Kubernetes, the Alpha announcement covers the motivation, the three primary components (the CSI SnapshotMetadata gRPC service, the SnapshotMetadataService CRD, and the external-snapshot-metadata sidecar), and a walkthrough of how to use the API. CBT currently applies to block volumes; file-volume and network file-share changed-list tracking is not covered by this feature. This post focuses on what is different in Beta. What's new in Beta The main change in that release was the promotion of the SnapshotMetadataService CRD from v1alpha1 to v1beta1. The CRD used to advertise a driver's metadata service now serves cbt.storage.k8s.io/v1beta1. The schema itself is unchanged, but this release removed v1alpha1 (rather than serving it alongside the new version). If you are upgrading from Alpha, you need to: Re-apply the CRD definition shipped with v1.0.0. Update SnapshotMetadataService manifests to use apiVersion: cbt.storage.k8s.io/v1beta1. Update any client or controller code that talks to the CRD. This is a one-time change. There is no automatic conversion between the two versions. Compatibility Minimum Kubernetes version: 1.33 CSI spec: 1.10 or newer Container image: registry.k8s.io/sig-storage/csi-snapshot-metadata:v1.0.0 Trying it out The Getting Started section in the Alpha blog still applies. In short: Make sure your CSI driver supports volume snapshots and ships the external-snapshot-metadata sidecar. Install the SnapshotMetadataService CRD (the v1beta1 definition from the v1.0.0 release). Create a SnapshotMetadataService resource for your driver. Use a client -- snapshot-metadata-lister, or your own implementation -- to call GetMetadataAllocated and GetMetadataDelta. If you want to see the full flow end-to-e

## New year, new image: Introducing the Chainguard Images Directory

DevFeed: [New year, new image: Introducing the Chainguard Images Directory](<https://devfeed.tech/articles/new-year-new-image-introducing-the-chainguard-images-directory-13184.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/new-year-new-image-introducing-the-chainguard-images-directory>)

Published: 2023-12-13T00:00:00Z

Content type: release

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [Docker Hardened Images](<https://devfeed.tech/topics/docker-hardened-images.md>), [Docker Hub](<https://devfeed.tech/topics/docker-hub.md>), [vulnerability](<https://devfeed.tech/topics/vulnerability.md>), [Security](<https://devfeed.tech/topics/security.md>)

Tags: [chainguard](<https://devfeed.tech/tags/chainguard.md>), [chainguard-images](<https://devfeed.tech/tags/chainguard-images.md>), [chainguard-images-directory](<https://devfeed.tech/tags/chainguard-images-directory.md>), [common-vulnerabilities-and-exposures](<https://devfeed.tech/tags/common-vulnerabilities-and-exposures.md>), [container-image-registry](<https://devfeed.tech/tags/container-image-registry.md>), [container-images](<https://devfeed.tech/tags/container-images.md>), [digestabot](<https://devfeed.tech/tags/digestabot.md>), [security](<https://devfeed.tech/tags/security.md>), [vulnerability](<https://devfeed.tech/tags/vulnerability.md>)

### AI overview

Chainguard introduces an updated Images Directory for discovering and using its minimal, hardened container images. The release also adds Security Advisories with information about CVE mitigation and introduces digestabot, a free GitHub Action for keeping Developer Images current.

### Source excerpt

Discover how the updated Chainguard Images Directory simplifies finding container images and critical vulnerability advisories.

## A guide on how to use Chainguard Images for public catalog tier users

DevFeed: [A guide on how to use Chainguard Images for public catalog tier users](<https://devfeed.tech/articles/a-guide-on-how-to-use-chainguard-images-for-public-catalog-tier-users-12858.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/a-guide-on-how-to-use-chainguard-images-for-public-catalog-tier-users>)

Published: 2023-06-23T00:00:00Z

Content type: article

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [chainguard images](<https://devfeed.tech/topics/chainguard-images.md>), [migration](<https://devfeed.tech/topics/migration.md>), [supply-chain-security](<https://devfeed.tech/topics/supply-chain-security.md>), [Open Source](<https://devfeed.tech/topics/open-source.md>)

Tags: [chaingaurd-images](<https://devfeed.tech/tags/chaingaurd-images.md>), [chainguard](<https://devfeed.tech/tags/chainguard.md>), [chainguard-images](<https://devfeed.tech/tags/chainguard-images.md>), [container](<https://devfeed.tech/tags/container.md>), [container-image-registry](<https://devfeed.tech/tags/container-image-registry.md>), [container-images](<https://devfeed.tech/tags/container-images.md>), [guide](<https://devfeed.tech/tags/guide.md>), [how-to](<https://devfeed.tech/tags/how-to.md>), [images](<https://devfeed.tech/tags/images.md>), [migration](<https://devfeed.tech/tags/migration.md>), [open-source](<https://devfeed.tech/tags/open-source.md>), [open-source-software](<https://devfeed.tech/tags/open-source-software.md>), [secure-by-default](<https://devfeed.tech/tags/secure-by-default.md>), [secure-container-image](<https://devfeed.tech/tags/secure-container-image.md>), [secure-minimal-image](<https://devfeed.tech/tags/secure-minimal-image.md>), [software-supply-chain](<https://devfeed.tech/tags/software-supply-chain.md>), [wolfi](<https://devfeed.tech/tags/wolfi.md>)

### AI overview

This guide explains a policy change affecting Chainguard Images public catalog users. From August 16, 2023, public-tier users can pull only the latest tags and continue to pull images by digest; access to other tags requires a Standard or Custom catalog subscription. It describes the impact on existing build processes, authentication errors, migration options, and technical approaches for using images without version tags.

### Source excerpt

Learn about the upcoming Chainguard Images catalog changes and the actions required for Public tier users.

## Building Chainguard's container image registry

DevFeed: [Building Chainguard's container image registry](<https://devfeed.tech/articles/building-chainguard-s-container-image-registry-12903.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/building-chainguards-container-image-registry>)

Published: 2023-05-23T00:00:00Z

Content type: article

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [Security](<https://devfeed.tech/topics/security.md>), [supply-chain-security](<https://devfeed.tech/topics/supply-chain-security.md>), [chainguard images](<https://devfeed.tech/topics/chainguard-images.md>), [GitHub Actions](<https://devfeed.tech/topics/github-actions.md>), [OpenID connect (OIDC)](<https://devfeed.tech/topics/oidc.md>), [Cloudflare](<https://devfeed.tech/topics/cloudflare.md>), [GitHub](<https://devfeed.tech/topics/github.md>)

Tags: [chainguard](<https://devfeed.tech/tags/chainguard.md>), [chainguard-image-registry](<https://devfeed.tech/tags/chainguard-image-registry.md>), [cloudflare](<https://devfeed.tech/tags/cloudflare.md>), [container](<https://devfeed.tech/tags/container.md>), [container-image](<https://devfeed.tech/tags/container-image.md>), [container-image-registry](<https://devfeed.tech/tags/container-image-registry.md>), [github-actions](<https://devfeed.tech/tags/github-actions.md>), [github-container-registry](<https://devfeed.tech/tags/github-container-registry.md>), [hardened-image](<https://devfeed.tech/tags/hardened-image.md>), [minimal-image](<https://devfeed.tech/tags/minimal-image.md>), [oidc](<https://devfeed.tech/tags/oidc.md>), [registry](<https://devfeed.tech/tags/registry.md>), [secure-by-design](<https://devfeed.tech/tags/secure-by-design.md>), [secure-container-images](<https://devfeed.tech/tags/secure-container-images.md>), [secure-images](<https://devfeed.tech/tags/secure-images.md>), [secure-minimal-image](<https://devfeed.tech/tags/secure-minimal-image.md>), [security](<https://devfeed.tech/tags/security.md>), [software-supply-chain-security](<https://devfeed.tech/tags/software-supply-chain-security.md>)

### AI overview

Chainguard explains why it built its own passwordless container image registry to improve security, control distribution, and manage costs. The registry is built on Cloudflare R2, uses short-lived OIDC credentials, and allows GitHub Actions workflows--not individual employees--to push images.

### Source excerpt

We built a passwordless container image registry with a focus on security to sustain the foundation for ongoing product growth & feature additions for our users.