Artifact Keeper on Ubuntu 24.04 LTS

Why the cloudimg image

A registry is only as trustworthy as the credential in front of it, so this image ships with none that anyone could know. The administrator password, the secret that signs tokens and sessions, the database password and the TLS material are all generated uniquely on each instance's first boot, and the registry keeps its own setup lock armed so that password must be changed before the API will serve a single request. No two deployments share a credential, nothing usable exists in the image at any moment, and anonymous access is switched off rather than left on, so an unauthenticated caller is refused instead of being shown a read only view.

Only SSH and HTTPS are reachable. The registry's own services never leave the loopback interface, there is no plaintext port at all, not even one that would merely redirect, and the database has no network listener whatsoever. The application runs from the official upstream images pinned by digest and started with pulling disabled, so an instance can never fetch different bytes than the ones that were measured, while the TLS terminator and the database are ordinary distribution packages that keep receiving security updates for the life of the release.

An on instance self test proves the whole posture at any time: it pushes an artifact through the real front door, fetches it back and compares the bytes, confirms a read only token cannot write, removes everything it created, and confirms every refusal the registry is supposed to make. Each of its checks is itself tried against a known bad input first, so a check that had stopped working would be caught rather than quietly passing. The optional scanning and search services are deliberately switched off, because they do not fit comfortably on the recommended instance size and their vulnerability databases would be stale the day the image was captured; the deploy guide explains what each one adds and how to turn it on. Every image is paired with a step by step deploy guide tested against this exact build and backed by 24/7 cloudimg support.