Container Registry across clouds

Private container image registries (ECR, ACR, Artifact Registry) with verified, access-scoped modules.

12 verified modules, 3 of them live-tested apply→verify→destroy; the rest are static-validated, live-test pending.

Compare by provider

Provider	Module	Verification
Alibaba Cloud	A Registry Where Pushing v1.4.2 Twice Is an Error	static-validated
AWS	ECR Repository	✓ live-tested
Azure	Azure Container Registry	✓ live-tested
DigitalOcean	A Container Registry Whose Credentials Expire	static-validated
Google Cloud	Artifact Registry Repositories	✓ live-tested
Huawei Cloud	An SWR Organization with Private Repositories	static-validated
IBM Cloud	A Container Registry Namespace with the Retention Policy that Keeps It from Filling	static-validated
Oracle Cloud	Repositories that Are Declared, Private and Immutable	static-validated
OVHcloud	A Private Registry that Answers Only to the Ranges You Say	static-validated
Scaleway	A Private Registry Namespace with a Push Key that Is Scoped and Expires	static-validated
Tencent Cloud	A TCR Basic Instance, Private, with Namespaces that Scan on Push and Refuse Vulnerable Images	static-validated
Vultr	A Private Vultr Container Registry on the Plan You Chose	static-validated

Co-locate the registry with the runtime that pulls images to cut pull latency and egress; enable image scanning where offered.

For public open-source images, a public registry is simpler - a private registry is for your own artifacts.