Container Registry Comparison: ECR vs GCR vs Docker Hub vs GHCR

What Is a Container Registry?

A container registry stores and distributes OCI-compliant container images. Your CI/CD pipeline builds an image, tags it (e.g., myapp:v1.2.3), and pushes it to the registry. When Kubernetes or ECS deploys the app, it pulls the image from the registry.

Key capabilities to evaluate:

• Authentication — How does your cluster authenticate to pull images?
• Access control — Can you limit who can push vs pull, per repository?
• Vulnerability scanning — Does it scan images on push?
• Rate limits — Will pulls get throttled under load?
• Geographic availability — Can images be replicated close to your clusters?
• Pricing — Storage and egress costs at scale.

Feature Comparison Table

Authenticating to Each Registry

AWS ECR — IAM-Based Auth

ECR uses short-lived tokens generated via aws ecr get-login-password. Tokens expire after 12 hours, so static imagePullSecrets break overnight. For EKS, use the ECR credential provider plugin — it refreshes tokens automatically at the node level.

# Login to ECR
aws ecr get-login-password --region us-east-1 \
  | docker login --username AWS \
    --password-stdin 123456789.dkr.ecr.us-east-1.amazonaws.com

# Push image
docker tag myapp:latest 123456789.dkr.ecr.us-east-1.amazonaws.com/myapp:latest
docker push 123456789.dkr.ecr.us-east-1.amazonaws.com/myapp:latest

GitHub GHCR — GITHUB_TOKEN

GHCR integrates with GitHub Actions natively. Use GITHUB_TOKEN for same-repository images — no PAT needed. For cross-repository pulls, create a PAT with read:packages scope.

# GitHub Actions workflow
- name: Log in to GHCR
  uses: docker/login-action@v3
  with:
    registry: ghcr.io
    username: {{ github.actor }}
    password: {{ secrets.GITHUB_TOKEN }}

- name: Build and push
  uses: docker/build-push-action@v5
  with:
    push: true
    tags: ghcr.io/{{ github.repository }}:latest

GCP Artifact Registry — Workload Identity

For GKE, use Workload Identity Federation to bind a Kubernetes Service Account to a GCP Service Account — no credentials in Kubernetes Secrets. For local dev, use gcloud auth configure-docker.

# Configure docker to use gcloud credentials
gcloud auth configure-docker us-central1-docker.pkg.dev

# Push to Artifact Registry
docker tag myapp:latest us-central1-docker.pkg.dev/my-project/my-repo/myapp:latest
docker push us-central1-docker.pkg.dev/my-project/my-repo/myapp:latest

Pricing Comparison (2026)

Note: ECR egress is free when pulling from EC2/ECS/EKS in the same AWS region. Cross-region or internet egress costs apply.

Choosing the Right Registry