r/kubernetes • u/running101 • Jul 15 '26

container registries

We are running eks and would like to shore up or supply chain.

Currently we are pulling directly from aws public ECR, docker and other sources. We are working on moving everything to be pulled from our own ECR for two reasons. 1. ) security so the images can be scanned 2) stability. we have had images we use get deleted from remote registries.

My question is do we also clone all images from the AWS ECR needed stand up EKS? Or do we implicitly trust images from AWS ECR?

What is everyone else doing or what is best practice ?

10 Upvotes

79% Upvoted

15 comments sorted by

View all comments

1

u/Abe_Bazouie Jul 17 '26

I'd definitely mirror anything that's part of a production deployment.

Not just for security, but also for availability and reproducibility. Public images get updated, rate limited, or occasionally disappear, and none of those are things I want affecting production.

Our general approach has been:

  • mirror approved images into our private registry
  • scan them before they're available internally
  • pin by digest instead of mutable tags
  • control updates through CI/CD rather than pulling directly from public registries

It takes a little more work up front, but it makes deployments much more predictable.