<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Container Registry Security — API Reference

## AWS ECR CLI

```bash
# List repositories
aws ecr describe-repositories --query 'repositories[].{name:repositoryName,uri:repositoryUri}'

# Enable scan on push
aws ecr put-image-scanning-configuration --repository-name REPO --image-scanning-configuration scanOnPush=true

# Enhanced scanning
aws ecr put-registry-scanning-configuration --scan-type ENHANCED \
  --rules '[{"scanFrequency":"CONTINUOUS_SCAN","repositoryFilters":[{"filter":"*","filterType":"WILDCARD"}]}]'

# Get scan findings
aws ecr describe-image-scan-findings --repository-name REPO --image-id imageTag=TAG

# Tag immutability
aws ecr put-image-tag-mutability --repository-name REPO --image-tag-mutability IMMUTABLE

# Lifecycle policy
aws ecr put-lifecycle-policy --repository-name REPO --lifecycle-policy-text '{"rules":[...]}'
aws ecr get-lifecycle-policy --repository-name REPO

# Repository policy
aws ecr set-repository-policy --repository-name REPO --policy-text '{"Statement":[...]}'
aws ecr get-repository-policy --repository-name REPO

# List images
aws ecr list-images --repository-name REPO
aws ecr describe-images --repository-name REPO --image-ids imageTag=TAG
```

## Azure ACR CLI

```bash
# List repositories
az acr repository list --name ACR_NAME

# Show repository details
az acr repository show --name ACR_NAME --repository REPO

# Enable content trust
az acr config content-trust update --registry ACR_NAME --status Enabled

# Vulnerability scan results
az acr repository show-manifests --name ACR_NAME --repository REPO --detail

# Network rules
az acr network-rule list --name ACR_NAME
az acr network-rule add --name ACR_NAME --ip-address CIDR
```

## GCP Artifact Registry CLI

```bash
# List repositories
gcloud artifacts repositories list --location=LOCATION

# List images
gcloud artifacts docker images list LOCATION-docker.pkg.dev/PROJECT/REPO

# Show vulnerabilities
gcloud artifacts docker images list LOCATION-docker.pkg.dev/PROJECT/REPO --show-occurrences --occurrence-filter="kind=\"VULNERABILITY\""

# IAM policy
gcloud artifacts repositories get-iam-policy REPO --location=LOCATION
gcloud artifacts repositories add-iam-policy-binding REPO --location=LOCATION --member=MEMBER --role=ROLE
```

## Image Scanning Tools

```bash
# Trivy
trivy image --severity HIGH,CRITICAL IMAGE:TAG
trivy image --format json IMAGE:TAG
trivy image --format spdx-json IMAGE:TAG  # SBOM

# Grype
grype IMAGE:TAG
grype IMAGE:TAG --output json

# Cosign
cosign sign --key cosign.key IMAGE@DIGEST
cosign verify --key cosign.pub IMAGE@DIGEST
cosign attach sbom --sbom sbom.json IMAGE@DIGEST

# Syft (SBOM)
syft IMAGE:TAG -o spdx-json
```

## Severity Mapping

| ECR | Trivy | CVSS |
|-----|-------|------|
| CRITICAL | CRITICAL | 9.0-10.0 |
| HIGH | HIGH | 7.0-8.9 |
| MEDIUM | MEDIUM | 4.0-6.9 |
| LOW | LOW | 0.1-3.9 |
