Artifact Registry Complete Guide (2026)

Artifact Registry is GCP's unified artifact repository, recommended since 2022 as the successor to Container Registry (GCR). It supports 10+ formats beyond Docker — Maven, npm, Python, Apt, Yum, Helm, and more — and integrates supply-chain security features.

Migration from GCR

2023-05: New GCR creation halted
2025-03: Phased shutdown
2026: GCR fully retired (planned)
Existing GCR is auto-migrated to Artifact Registry (the gcr.io hostname is preserved)

Supported Repository Formats

Format	Use case
Docker	Container images
Maven	Java / Kotlin / Scala
npm	JavaScript / TypeScript
Python (PyPI)	Python packages
Apt	Debian / Ubuntu
Yum	RHEL / CentOS
Helm	Kubernetes Chart
Go	Go modules
Generic	Arbitrary files
KubeflowPipelines	ML pipelines

Repository Types

Type	Use case
Standard	First-party uploads
Remote	Proxy + cache for Docker Hub / Maven Central / PyPI and similar
Virtual	Unifies multiple Standard / Remote repositories behind a single endpoint

Docker Usage Example

# Authenticate
gcloud auth configure-docker asia-northeast1-docker.pkg.dev

# Create the repository
gcloud artifacts repositories create my-repo \
  --repository-format=docker --location=asia-northeast1

# Push the image
docker tag my-app:v1 asia-northeast1-docker.pkg.dev/PROJECT/my-repo/my-app:v1
docker push asia-northeast1-docker.pkg.dev/PROJECT/my-repo/my-app:v1

Vulnerability Scanning

Automatic scan on push (Container Analysis integration)
OS packages plus language packages (Maven / npm / Python / Go, etc.)
CVSS scores and CVE details
Pub/Sub notifications alert you when a Critical finding is detected
Pricing: $0.26 per image scan (first scan)
SBOM (Software Bill of Materials) is generated automatically

Security Best Practices

Enforce least privilege with IAM (roles/artifactregistry.reader / writer / admin)
Lock down access inside a VPC SC perimeter
Encrypt with CMEK
Combine with Binary Authorization for signature verification
Run image vulnerability scans on a regular cadence
Auto-delete old tags with cleanup policies

Pricing

Item	Price
Storage	$0.10/GB/month
Free tier	0.5 GB/month
Egress (same-region GCP)	Free
Egress (cross-region / external)	Standard egress rates
Vulnerability Scan	$0.26/image (first scan)

Cross-Cloud Comparison

Item	Artifact Registry	AWS ECR	Azure ACR
Container	Excellent	Excellent	Excellent
Maven / npm / Python	Excellent	—	—
Helm	Excellent	Good (OCI Helm)	Good
Geo-replication	Multi-region	Cross-region Replication	Geo-replication
Vulnerability scanning	Container Analysis	ECR Scanning	Defender for Cloud

How is it different from Container Registry (GCR)?

GCR is being deprecated (starting 2025) and Artifact Registry is its successor. AR supports Container plus Maven / npm / Python / Apt / Yum / Generic formats.

Which repository formats are supported?

10+ formats are supported, including Docker, Maven, npm, Python (PyPI), Apt (Debian), Yum (RHEL), Helm, Go, Generic, and KubeflowPipelines.

What is the difference between Standard and Remote?

Standard is for direct uploads, while Remote acts as a proxy plus cache for Docker Hub / Maven Central / PyPI and similar registries. A Virtual Repository can unify both behind a single endpoint.

How does vulnerability scanning work?

Container Analysis is integrated, so a CVE scan runs automatically on push. Critical / High vulnerabilities trigger alerts, and SBOM generation is supported.

What is the pricing model?

Storage ($0.10/GB/month) plus network egress. 0.5 GB/month is free, and pulls from same-region GCE / GKE / Cloud Run are free.

How does it combine with Binary Authorization?

Scan with AR's Container Analysis, sign with Cosign, then verify the signature with Binary Authorization before deployment. This is the standard supply-chain security flow.

How does it compare to AWS ECR and Azure ACR?

ECR is AWS-only with ECR Public. ACR is well integrated with Azure and has strong geo-replication. AR's advantages are multi-format support (Maven / npm, etc.) and the Remote / Virtual repository concepts.

How does multi-region / cross-region replication work?

Multi-region repositories (US / EU / ASIA) and custom geo-locations are supported. Cross-region replication is handled via manual sync or pull-through cache as a workaround.

Check what you learned with practice questions

Practice with certification-focused question sets

View GCP exam prep page

Author

NicheeLab Editorial Team

NicheeLab editorial team focused on data engineering and cloud certification learning. Content is structured around practical study needs and official exam domains.

Artifact Registry Complete Guide: GCR Successor for Docker/Maven/npm/Python