Container Registry is deprecated and scheduled for shutdown. Effective May 15, 2024, Artifact Registry hosts images for the gcr.io domain in projects without previous Container Registry usage. After March 18, 2025, Container Registry will be shut down.

To get started with managing containers on Google Cloud, use Artifact Registry. If you use Container Registry, learn how to transition to Artifact Registry to manage your containers on Google Cloud.

For more information on the deprecation and shutdown, see the deprecations page and release notes.

Securing Container Registry in a service perimeter

VPC Service Controls improves your ability to mitigate the risk of unauthorized copying or transfer of data from Google-managed services.

With VPC Service Controls, you can configure security perimeters around the resources of your Google-managed services and control the movement of data across the perimeter boundary.

Using Container Registry with VPC Service Controls

If you are using Container Registry and Google Kubernetes Engine private clusters in a project within a service perimeter, you can access container images inside the service perimeter as well as Google-provided images.

You can access Container Registry using the IP addresses for the default Google APIs and services domains, or using these special IP addresses:

199.36.153.4/30 (restricted.googleapis.com)
199.36.153.8/30 (private.googleapis.com)

For details about these options, see Configuring Private Google Access. For an example configuration that uses 199.36.153.4/30 (restricted.googleapis.com), see the documentation for registry access with a virtual IP.

For general instructions to add Container Registry to a service perimeter, see Creating a service perimeter.

Using Artifact Analysis with VPC Service Controls

To learn how to add Artifact Analysis to your perimeter, see the securing Artifact Analysis in a service perimeter.