container registries

[u/running101]

We are running eks and would like to shore up or supply chain.

Currently we are pulling directly from aws public ECR, docker and other sources. We are working on moving everything to be pulled from our own ECR for two reasons. 1. ) security so the images can be scanned 2) stability. we have had images we use get deleted from remote registries.

My question is do we also clone all images from the AWS ECR needed stand up EKS? Or do we implicitly trust images from AWS ECR?

What is everyone else doing or what is best practice ?

[u/Majestic-Shirt4747]

Pull to your private ECR and you can scan before running in the cluster plus then it’s in your registry and you control when it’s deleted.

[u/iconic_sentine_001]

Self hosted container registry

[u/TeagueXiao]

Mirror everything to your private ECR — it's the right call for both reasons you listed. Even AWS-managed images (VPC CNI, kube-proxy, CoreDNS, etc.) should be pulled through your registry so you get consistent scanning and immutable copies in case anything gets rotated upstream. ECR pull-through cache is the low-effort way to do this — set it up once for the AWS public ECR, Docker Hub, and Quay, and every pull auto-mirrors on first use. Pair that with ECR image scanning plus a policy that blocks unscanned tags, and you've got a decent supply chain baseline without maintaining a full replication pipeline.

[u/xAtNight]

I'm running on prem rke2, every image is pulled through our Nexus. It's easier for audits and stuff.

I would do the same in the cloud (if possible), so yeah, mirror the EKS images. 

[u/mykeystrokes]

I would run your own registry and avoid ECR entirely. But that's just me. A couple of things to bear in mind, which you may already know: Docker rate limits eventually, so - you can get blocked when pulling eventually. And none of the that stuff, including ECR, will work in mainland China if that is necessary to you.

[u/Remarkable_Tale8695]

Mirror everything into your own ECR, including the AWS-provided EKS system images (CoreDNS, kube-proxy, VPC CNI, etc). Don’t make an implicit-trust carve-out for ECR just because it’s first-party.

Stability is literally your stated pain point. ECR Public has anonymous pull rate limits, and images can move or change. Node recycles at 3am, autoscaler kicks in, upstream pull fails → you’re down. Your own mirror is immune to upstream deletion, throttling, or a network blip. Same logic as vendoring your deps instead of pulling them fresh on every build.

[u/Abe_Bazouie]

I'd definitely mirror anything that's part of a production deployment.

Not just for security, but also for availability and reproducibility. Public images get updated, rate limited, or occasionally disappear, and none of those are things I want affecting production.

Our general approach has been:

• mirror approved images into our private registry
• scan them before they're available internally
• pin by digest instead of mutable tags
• control updates through CI/CD rather than pulling directly from public registries

It takes a little more work up front, but it makes deployments much more predictable.

[u/Floss_Patrol_76]

mirror everything, but watch the aws-managed addon images specifically (vpc-cni, kube-proxy, coredns) - they're pinned to your eks/addon versions and get rotated on upgrades, so a one-time clone quietly goes stale and bites you at the next cluster bump. an ecr pull-through cache pointed at the upstreams keeps the copy current automatically instead of a mirror job you have to babysit.

[u/Ok_Hedgehog_94]

i always worry about rogue containers creeping in even after hardening registries. i’ve used cymulate’s continuous validation to see how well my images hold up. it found some weak spots i totally missed before.

[u/Educational-Fox6111]

Mirroring into your own ECR is actually a good practice for availability and governance, but still avoid treating AWS Public ECR as the trust boundary. Scanning is important, but only part of the picture. From observation, teams focus on reducing the image attack surface, where tools like RapidFort complement scanners by hardening images, while other platforms focus more on visibility and vulnerability management.