Quay Container Registry

Quay is a container-image registry product from Red Hat. It stores and distributes OCI and Docker-compatible images, with organization and repository access controls, robot accounts, vulnerability scanning integrations, and optional repository mirroring. A registry is not a source-control system: image tags identify published artifacts, while source and build definitions should remain in version control.

Publish an Image #

Create an organization and repository, then authenticate with a scoped robot-account token rather than a personal password:

docker login quay.io
docker build -t quay.io/example-org/web:1.4.0 .
docker push quay.io/example-org/web:1.4.0

Deployments should use an immutable version tag or digest:

docker pull quay.io/example-org/web@sha256:REPLACE_WITH_IMAGE_DIGEST

Tags such as latest are mutable pointers and are convenient for development, but they do not prove which image a deployment used.

Operate a Private Registry #

Self-hosted Quay requires durable object storage or filesystem storage, a database, TLS termination, backups, and an authentication integration. Before production use, define retention policies, test a restore, and monitor storage growth. Garbage collection and cleanup policies must respect images still referenced by deployments or release records.

Use least-privilege teams and robot accounts: a CI publisher normally needs write access only to its repository, while a runtime pull secret needs read access only. Enable image scanning where available, but treat scan results as one input to patching and admission decisions rather than proof that an image is safe.