Using container registries securely

    • Organize images into repositories that can include multiple versions of an image

    • Optionally limit access to images, based on different authentication methods, or make them publicly available

    There are public container registries, such as Quay.io and Docker Hub where many people and organizations share their images. The Red Hat Registry offers supported Red Hat and partner images, while the Red Hat Ecosystem Catalog offers detailed descriptions and health checks for those images. To manage your own registry, you could purchase a container registry such as Red Hat Quay.

    From a security standpoint, some registries provide special features to check and improve the health of your containers. For example, Red Hat Quay offers container vulnerability scanning with Clair security scanner, build triggers to automatically rebuild images when source code changes in GitHub and other locations, and the ability to use role-based access control (RBAC) to secure access to images.

    There are tools you can use to scan and track the contents of your downloaded and deployed container images. However, there are many public sources of container images. When using public container registries, you can add a layer of protection by using trusted sources.

    Consuming security updates is particularly important when managing immutable containers. Immutable containers are containers that will never be changed while running. When you deploy immutable containers, you do not step into the running container to replace one or more binaries. From an operational standpoint, you rebuild and redeploy an updated container image to replace a container instead of changing it.

    Red Hat certified images are:

    • Free of known vulnerabilities in the platform components or layers

    • Supported by Red Hat

    The list of known vulnerabilities is constantly evolving, so you must track the contents of your deployed container images, as well as newly downloaded images, over time. You can use to alert you to any newly discovered issues in Red Hat certified container images, and direct you to the updated image. Alternatively, you can go to the Red Hat Ecosystem Catalog to look up that and other security-related issues for each Red Hat image.

    Red Hat lists certified container images for Red Hat products and partner offerings from the Container Images section of the Red Hat Ecosystem Catalog. From that catalog, you can see details of each image, including CVE, software packages listings, and health scores.

    Red Hat images are actually stored in what is referred to as the Red Hat Registry, which is represented by a public container registry () and an authenticated registry (). Both include basically the same set of container images, with including some additional images that require authentication with Red Hat subscription credentials.

    Container content is monitored for vulnerabilities by Red Hat and updated regularly. When Red Hat releases security updates, such as fixes to glibc, , or Dirty Cow, any affected container images are also rebuilt and pushed to the Red Hat Registry.

    Red Hat uses a to reflect the security risk for each container provided through the Red Hat Ecosystem Catalog. Because containers consume software provided by Red Hat and the errata process, old, stale containers are insecure whereas new, fresh containers are more secure.

    To illustrate the age of containers, the Red Hat Ecosystem Catalog uses a grading system. A freshness grade is a measure of the oldest and most severe security errata available for an image. “A” is more up to date than “F”. See for more details on this grading system.

    See the Red Hat Product Security Center for details on security updates and vulnerabilities related to Red Hat software. Check out to search for specific advisories and CVEs.

    OKD includes the OpenShift Container Registry, a private registry running as an integrated component of the platform that you can use to manage your container images. The OpenShift Container Registry provides role-based access controls that allow you to manage who can pull and push which container images.

    Additional resources

    Red Hat Quay is an enterprise-quality container registry product from Red Hat. Development for Red Hat Quay is done through the upstream . Red Hat Quay is available to deploy on-premise or through the hosted version of Red Hat Quay at Quay.io.

    Security-related features of Red Hat Quay include:

    • Time machine: Allows images with older tags to expire after a set period of time or based on a user-selected expiration time.

    • : Lets you mirror other registries for security reasons, such hosting a public repository on Red Hat Quay behind a company firewall, or for performance reasons, to keep registries closer to where they are used.

    • Action log storage: Save Red Hat Quay logging output to Elasticsearch storage to allow for later search and analysis.

    • : Scan images against a variety of Linux vulnerability databases, based on the origins of each container image.

    • Internal authentication: Use the default local database to handle RBAC authentication to Red Hat Quay or choose from LDAP, Keystone (OpenStack), JWT Custom Authentication, or External Application Token authentication.

    Ongoing integration of Red Hat Quay with OKD continues, with several OKD Operators of particular interest. The Quay Bridge Operator lets you replace the internal OKD registry with Red Hat Quay. The lets you check vulnerabilities of images running in OKD that were pulled from Red Hat Quay registries.