Connecting Container Registries: ECR, OCI, GCP and Docker Hub

IntermediateFree5 modules · 15 lessons · ~2 min

About this course

A platform engineer's guide to connecting Amazon ECR, OCI Registry, GCP Cloud Source and Docker Hub as scanning inputs and operating those connections over time. You will choose the right authentication model per provider, pin references by digest instead of trusting mutable tags, separate base-image from application-layer findings, manage rate limits, mirrors and private networking, verify signatures and provenance attestations, and design continuous rescanning so new CVEs are caught against images you already deployed.

What you'll learn

Registry Connections as a Trust Boundary

Why the Registry Connection Is a Distinct Trust Boundary
Amazon ECR: IAM Roles, Temporary Tokens and Cross-Account Access
OCI Registry, GCP Cloud Source and Docker Hub: Service Accounts, Workload Identity and Tokens

Tags, Digests and What Gets Scanned

Tags Are Mutable: Pulling and Pinning by Digest
Multi-Arch Manifests: What a Digest Actually Points To
Scanning Base Images versus Application Layers

Rate Limits, Mirrors and Private Networking

Docker Hub Rate Limits and Pull-Through Mirror Strategies
Private Registry Networking: VPC Endpoints, Firewalls and Egress
Self-Hosted and Air-Gapped Registries: The Local Runner Pattern

01Registry Connections as a Trust Boundary3 lessons

Why the Registry Connection Is a Distinct Trust Boundary
Amazon ECR: IAM Roles, Temporary Tokens and Cross-Account Access
OCI Registry, GCP Cloud Source and Docker Hub: Service Accounts, Workload Identity and Tokens

02Tags, Digests and What Gets Scanned3 lessons

Common questions

How much does Safeguard Academy cost?

Nothing. Every course, exam, and certificate on the catalog is free — including retakes. All you need is a free Safeguard account.

What are the prerequisites?

None. The flagship course, Safeguard Certified Practitioner, is a beginner-level course — basic familiarity with how software is built helps, but every exam question is answerable from the lessons themselves.

Signing and Attestation Verification

Image Signing with Cosign and Sigstore: What Verification Proves
SLSA Provenance Attestations: Reading and Verifying Build Claims
Trusted Artifacts: Composing Signature, Provenance and Scan Verdicts

Operating the Connection Over Time

Continuous Rescanning: New CVEs Against Images Already Deployed
Choosing Scan Triggers: Push, Schedule and On-Demand
Troubleshooting, Rotating Credentials and Decommissioning a Connection

Tags Are Mutable: Pulling and Pinning by Digest

Multi-Arch Manifests: What a Digest Actually Points To

Scanning Base Images versus Application Layers

03Rate Limits, Mirrors and Private Networking3 lessons

Docker Hub Rate Limits and Pull-Through Mirror Strategies
Private Registry Networking: VPC Endpoints, Firewalls and Egress
Self-Hosted and Air-Gapped Registries: The Local Runner Pattern

04Signing and Attestation Verification3 lessons

Image Signing with Cosign and Sigstore: What Verification Proves
SLSA Provenance Attestations: Reading and Verifying Build Claims
Trusted Artifacts: Composing Signature, Provenance and Scan Verdicts

05Operating the Connection Over Time3 lessons

Continuous Rescanning: New CVEs Against Images Already Deployed
Choosing Scan Triggers: Push, Schedule and On-Demand
Troubleshooting, Rotating Credentials and Decommissioning a Connection2 min

What happens if I fail the exam?

You can retake it after a 24-hour cooldown, as many times as you need. Retakes are free, and each attempt draws a fresh random set of questions.

How long is a certificate valid?

The Safeguard Certified Practitioner credential is valid for 24 months from issue. The expiry date is printed on the certificate and shown live on its public verification page. Renewing means passing the current exam again.