出于安全考量，容器仓库是否支持为Docker push/pull配置独立凭证？

Absolutely! Most modern container registries support granular permission controls that let you create separate credentials for pushing (writing) and pulling (reading) images. Let’s break down popular options and how to set this up:

Docker Hub #

• Create two distinct user accounts (or use team permissions):
  • For pull-only access: Add the user to your repository’s Collaborators section (under Settings), and assign the Read permission.
  • For push access: Assign the Write or Admin permission to another user account.
• Use each account’s credentials to log into Docker for their respective operations (pull vs push).

AWS Elastic Container Registry (ECR) #

• Use IAM policies to split permissions:
  • For pull operations: Create an IAM user/role and attach the AmazonEC2ContainerRegistryReadOnly managed policy.
  • For push operations: Create a separate IAM user/role with a policy that allows key actions like ecr:GetAuthorizationToken, ecr:InitiateLayerUpload, ecr:PutImage, plus the read actions needed to pull base images. You can use the AmazonEC2ContainerRegistryPowerUser managed policy as a starting point.
• Generate access keys for each IAM entity and use them to authenticate with ECR.

Google Artifact Registry (GCR is legacy, now replaced by Artifact Registry) #

• Leverage Cloud IAM roles:
  • For pull-only access: Assign the roles/artifactregistry.reader role to a service account or user.
  • For push access: Assign the roles/artifactregistry.writer role (this includes pull permissions, which are usually needed to push images that rely on base layers).
• Authenticate using service account keys or workload identity for automated workflows.

Harbor #

• Harbor’s built-in RBAC system makes this straightforward:
  • Create two user groups: A Pull-Only group with only the Pull permission enabled for your repositories, and a Push-Pull group with both Pull and Push permissions.
  • Create separate users for each group, then use their credentials to log in for the intended operation.

Azure Container Registry (ACR) #

• Use Azure RBAC roles to split access:
  • For pull-only access: Assign the AcrPull role to a user or service principal.
  • For push access: Assign the AcrPush role (this includes pull permissions, which are required for most push workflows).
• Authenticate using service principal secrets or Azure AD credentials.

• Always prefer service accounts/robot accounts over personal user accounts for automated workflows. This keeps permissions isolated and avoids disruptions if personal accounts change.
• For self-hosted open-source Docker Registry, the default permission system is basic, but you can integrate external auth (like LDAP) and add custom middleware or tools (e.g., Notary) to implement granular push/pull controls—though this requires more custom setup.

内容的提问来源于stack exchange，提问作者Divya Vyas