GCP for DevOps — Artifact Registry

Artifact Registry

Artifact Registry is Google Cloud’s universal package manager. It stores Docker images, npm packages, Maven/Gradle JARs, Python packages, Go modules, and more — with IAM-based access control and vulnerability scanning.

Supported Formats

Format	Use Case
Docker	Container images
npm	Node.js packages
Maven / Gradle	Java packages
Python (PyPI)	Python packages
Go	Go modules
Apt	Debian packages
Yum	RPM packages
KubeFlow Pipelines	ML pipelines

Create a Docker Repository

# Create a Docker repository
$ gcloud artifacts repositories create my-docker-repo \
    --repository-format=docker \
    --location=us-central1 \
    --description="Production Docker images"

# List repositories
$ gcloud artifacts repositories list --location=us-central1

REPOSITORY       FORMAT  LOCATION       DESCRIPTION
my-docker-repo   DOCKER  us-central1    Production Docker images

Authenticate Docker

# Configure Docker to use Artifact Registry
$ gcloud auth configure-docker us-central1-docker.pkg.dev

# This adds the registry to ~/.docker/config.json
# Now you can docker push/pull without separate auth

Push and Pull Docker Images

# Tag a local image for Artifact Registry
$ docker tag my-app:latest \
    us-central1-docker.pkg.dev/my-project/my-docker-repo/my-app:v1.0.0

# Push the image
$ docker push us-central1-docker.pkg.dev/my-project/my-docker-repo/my-app:v1.0.0

# Pull the image
$ docker pull us-central1-docker.pkg.dev/my-project/my-docker-repo/my-app:v1.0.0

# List images in a repository
$ gcloud artifacts docker images list \
    us-central1-docker.pkg.dev/my-project/my-docker-repo

IMAGE                                                          DIGEST         CREATE_TIME
us-central1-docker.pkg.dev/my-project/my-docker-repo/my-app   sha256:abc123  2026-03-30T10:00:00

Create an npm Repository

# Create npm repository
$ gcloud artifacts repositories create my-npm-repo \
    --repository-format=npm \
    --location=us-central1

# Configure npm to use Artifact Registry
$ gcloud artifacts print-settings npm \
    --repository=my-npm-repo \
    --location=us-central1 \
    --scope=@mycompany

# Add to .npmrc
# @mycompany:registry=https://us-central1-npm.pkg.dev/my-project/my-npm-repo/
# //us-central1-npm.pkg.dev/my-project/my-npm-repo/:_authToken=...

# Publish a package
$ npm publish --registry=https://us-central1-npm.pkg.dev/my-project/my-npm-repo/

Create a Python Repository

# Create Python repository
$ gcloud artifacts repositories create my-python-repo \
    --repository-format=python \
    --location=us-central1

# Configure pip
$ gcloud artifacts print-settings python \
    --repository=my-python-repo \
    --location=us-central1

# Install from Artifact Registry
$ pip install --index-url https://us-central1-python.pkg.dev/my-project/my-python-repo/simple/ my-package

# Upload a package
$ python -m twine upload \
    --repository-url https://us-central1-python.pkg.dev/my-project/my-python-repo/ \
    dist/*

Vulnerability Scanning

Artifact Registry automatically scans Docker images for vulnerabilities.

# Enable vulnerability scanning (on by default for new repos)
$ gcloud services enable containerscanning.googleapis.com

# List vulnerabilities for an image
$ gcloud artifacts docker images list \
    us-central1-docker.pkg.dev/my-project/my-docker-repo/my-app \
    --show-occurrences \
    --occurrence-filter="kind=\"VULNERABILITY\""

# Get detailed vulnerability report
$ gcloud artifacts vulnerabilities list \
    us-central1-docker.pkg.dev/my-project/my-docker-repo/my-app@sha256:abc123

Cleanup Policies

Automatically delete old images to save costs.

# Delete untagged images older than 30 days
$ gcloud artifacts repositories set-cleanup-policies my-docker-repo \
    --location=us-central1 \
    --policy='{"conditionalPolicy":{"tagState":"UNTAGGED","olderThan":"2592000s"},"action":"DELETE"}'

# Delete images and keep only the latest 10 tags
$ gcloud artifacts docker images delete \
    us-central1-docker.pkg.dev/my-project/my-docker-repo/my-app \
    --delete-tags --filter="createTime < 2026-01-01"

IAM Access Control

# Grant read access to a service account
$ gcloud artifacts repositories add-iam-policy-binding my-docker-repo \
    --location=us-central1 \
    --member="serviceAccount:deployer@my-project.iam.gserviceaccount.com" \
    --role="roles/artifactregistry.reader"

# Grant write access to Cloud Build
$ gcloud artifacts repositories add-iam-policy-binding my-docker-repo \
    --location=us-central1 \
    --member="serviceAccount:123456789@cloudbuild.gserviceaccount.com" \
    --role="roles/artifactregistry.writer"

Common Mistakes

Mistake	Why It’s Wrong	Fix
Using Container Registry (gcr.io)	Deprecated, migrate to AR	Use pkg.dev URLs
No cleanup policy	Storage costs grow	Set up auto-delete for old images
Missing Docker auth config	Push/pull fails	Run gcloud auth configure-docker
No vulnerability scanning	Security blind spot	Enable containerscanning.googleapis.com
Overly broad IAM roles	Security risk	Use reader/writer roles per repository

Quick Reference

Command	Description
gcloud artifacts repositories create R --format=docker	Create repository
gcloud auth configure-docker REGION-docker.pkg.dev	Auth Docker
docker push REGION-docker.pkg.dev/P/R/IMG:TAG	Push image
gcloud artifacts docker images list REPO	List images
gcloud artifacts vulnerabilities list IMAGE	Check vulns

Next → Cloud Deploy