Cloud Artifact Registry

Universal package manager for storing and managing build artifacts and dependencies in one place. Supports container images, Java, Python, Node.js packages, Helm charts, Go modules, and Ruby gems from a single, integrated platform.

Part of Google Cloud, Artifact Registry replaced Container Registry as the recommended option and expands on it with multi-format support, virtual and remote repositories, and tighter supply chain security. Virtual repositories group multiple upstream sources behind one endpoint with configurable priority for dependency resolution. Remote repositories proxy and cache public sources like Docker Hub, Maven Central, and PyPI for controlled access, vulnerability scanning, and build provenance.

Key capabilities:

• Multi-format support for Docker, Maven, npm, PyPI, Helm, Go modules, and Apt
• Virtual repositories to unify private and remote sources under a single endpoint
• Remote repositories for caching and securing dependencies from public registries
• Vulnerability and secret scanning via Artifact Analysis
• Native integration with Cloud Build, Cloud Run, GKE, Compute Engine, and App Engine
• Regional and multi-regional deployment with IAM-based access control

Engineering teams use Artifact Registry as the central store for CI/CD pipelines, container images for Kubernetes or serverless runtimes, and language package dependencies. It fits into existing toolchains via Docker CLI, Maven, npm, pip, and other standard clients. Security-conscious teams rely on it for scanning third-party packages before deployment and enforcing organization policies across the software supply chain.