ops/registry

Push container images to registries with immutable tags and signing.

3|1|Updated Feb 10, 2026

Search Tags:#devops #supply-chain #container-registry #image-signing #immutable-tags #image-push #registry-auth

Ready to run

npx skills add https://github.com/deandum/claude-resources --skill ops-registry

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: ops/registry
Source: https://github.com/deandum/claude-resources/tree/main/skills/ops/registry
Command: npx skills add https://github.com/deandum/claude-resources --skill ops-registry

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Pushing container images to a registry and selecting appropriate tag strategies is error-prone and risky for production deployments, requiring disciplined workflows to avoid runaway mutable tags, unverified releases, and supply-chain issues.

Core Features & Use Cases

Immutable tagging by default for reliable deployments and auditability.
Authentication, signing, and verification steps to protect the registry workflow.
Guidance on when and how to push to common registries (ECR, GCR, GHCR, Docker Hub) and how to handle mutable vs immutable tags during release cycles.
Use Case: You just built a new image and need to push it with a version tag, sign it, and update a mutable tag for canary rollout after validation.

Quick Start

Push a built image to the registry using an immutable tag and verify the push with a registry scan.

Frequently Asked Questions about ops/registry

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I push container images with immutable tags to prevent production issues?▼

Pre-push build health checks and scans are required before pushing container images to a registry. This workflow authenticates the registry, builds the image, and verifies its health to protect against supply-chain issues.

Can I push and sign container images across ECR, GCR, GHCR, and Docker Hub?▼

You can push and sign container images across ECR, GCR, GHCR, and Docker Hub. The workflow handles registry authentication and image signing to protect the registry workflow and secure deployments across these common platforms.

When should I use mutable vs immutable tags for container image deployments?▼

Use immutable tags by default for reliable deployments and auditability, while mutable tags can be updated for canary rollouts after validation. This strategy prevents unverified releases and maintains supply-chain security during release cycles.

What is the best way to automate image signing and registry authentication for deployments?▼

Automate image signing and registry authentication as part of the container image push workflow. This enforces verification steps and secures the deployment process, protecting the registry from supply-chain issues.

How do I handle a canary rollout using mutable tags after pushing a signed image?▼

Push a built image with a version tag, sign it, and update a mutable tag for canary rollout after validation. This ensures the image is verified before directing deployment traffic to the new release.