<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: auditing-container-registry-security
description: >-
  Audit container registry security configurations including access controls,
  image policies, vulnerability scanning integration, and content trust to
  prevent unauthorized image distribution.
domain: cybersecurity
subdomain: container-security
tags:
  - container-registry
  - access-control
  - content-trust
  - vulnerability-scanning
  - image-policy
  - harbor
  - ecr
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1525"]
---

# Auditing Container Registry Security

## Overview

Container registries are the supply chain choke point — compromise here means
every deployment pulls malicious images. This skill covers auditing access
controls on Harbor, ECR, GCR, and ACR, verifying scan-on-push configurations,
testing for anonymous access, validating TLS, and enforcing content trust
policies to prevent unauthorized image distribution.

Mode: `[MODE: BLUE]` — Defensive registry configuration audit.

## Prerequisites

| Requirement | Details |
|---|---|
| Docker CLI for registry inspection | Required |
| skopeo for remote image operations | Required |
| crane (go-containerregistry) for registry API | Required |
| Registry admin access for configuration audit | Required |

## Key Concepts

### Registry Access Control Audit

```bash
# ECR repository policies
aws ecr get-repository-policy --repository-name REPO | jq '.policyText | fromjson'

# GCR IAM audit
gcloud artifacts repositories get-iam-policy REPO --location=LOCATION --format=json

# Harbor project access
curl -s "https://harbor.example.com/api/v2.0/projects/PROJECT/members" \
  -H "Authorization: Basic BASE64" | jq '.[] | {entity_name, role_name}'
```

### Image Scanning Configuration

```bash
# ECR scan configuration
aws ecr put-image-scanning-configuration \
  --repository-name REPO \
  --image-scanning-configuration scanOnPush=true

# Check with skopeo
skopeo inspect docker://registry.example.com/app:latest | jq .
```

### Content Trust

```bash
export DOCKER_CONTENT_TRUST=1
docker push registry.example.com/app:v1.0
docker trust inspect registry.example.com/app:v1.0
```

### Registry Network Security

```bash
# Check TLS
openssl s_client -connect registry.example.com:443 -showcerts 2>/dev/null | \
  openssl x509 -noout -dates -subject -issuer

# Test anonymous access
skopeo inspect --no-creds docker://registry.example.com/app:latest
```

## Workflow

### Step 1: Audit Registry Configuration

```bash
node scripts/agent.js --audit-registry --registry registry.example.com \
  --output /tmp/registry-audit.json
```

### Step 2: Verify Scanning Configuration

```bash
node scripts/agent.js --verify-scanning --output /tmp/scan-config.json
```

## Detection

```yaml
title: Auditing Container Registry Security Detection
id: b44135f7-5842-4af4-b911-07319da6a237
status: experimental
description: Detects suspicious activity related to auditing container registry security techniques in container security context
logsource:
  product: kubernetes
  service: audit
detection:
  selection:
    eventName: "*Unauthorized*"
  condition: selection
level: medium
tags:
  - attack.t1525
  - attack.execution
falsepositives:
  - Container orchestration platform performing routine health checks
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Auditing Container Registry Security Detection | kubernetes | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1525 |

## Verification

- [ ] No anonymous pull access on private registries
- [ ] Image scanning enabled on push for all repositories
- [ ] Content trust enforced for production images
- [ ] Registry TLS certificates valid and not expiring within 30 days
- [ ] Repository access follows least privilege
- [ ] Registry audit logs enabled and forwarded to SIEM

## References

- [Docker Registry HTTP API V2](https://distribution.github.io/distribution/spec/api/)
- [Harbor Security Best Practices](https://goharbor.io/docs/)
- [AWS ECR Security](https://docs.aws.amazon.com/AmazonECR/latest/userguide/security.html)
- [CIS Docker Benchmark 2.x — Registry](https://www.cisecurity.org/benchmark/docker)
- [NIST SP 800-190 §4.1 — Image and Registry Security](https://csrc.nist.gov/publications/detail/sp/800-190/final)
