Top 8 Container Registries for 2026: Pull Rate Limits, Retention, Scanning, and Egress Priced

Pros

• GitHub documents container registry storage and bandwidth as currently free, with a commitment to give advance notice before changing it
• Public packages are entirely free and data transferred in is free from any source, on every plan
• No published per-pull rate limit, so CI pipelines do not need authentication gymnastics or a pull-through cache to avoid throttling
• Permissions inherit from the repository and organisation, so access control is one system rather than two
• Anonymous pulls of public images are supported, which matters for open-source distribution

Cons

• The free container registry position is explicitly described as current, not permanent, which is a real planning risk for a core dependency
• The wider GitHub Packages quotas that govern other package types are small: 500 MB storage and 1 GB monthly transfer on Free, 2 GB and 10 GB on Pro and Team, 50 GB and 100 GB on Enterprise Cloud
• No built-in vulnerability scanning for images; you run a scanner in CI or buy one separately
• Retention is managed through package version cleanup policies rather than a first-class lifecycle rule engine like ECR's
• Tightly coupled to GitHub identity, so a multi-forge or GitHub-independent estate gets less from it

Pros

• Data transfer from ECR to ECS, EKS, Lambda, App Runner, or Fargate in the same region is $0.00 per GB, which is the dominant cost factor at scale
• Lifecycle policies are a real rule engine with a test mode, so retention is enforced rather than aspirational
• Pull-through cache rules mirror upstream registries into your private ECR, which is the supported fix for Docker Hub rate limiting in AWS CI
• Basic scan-on-push is included at no extra charge per repository
• Public repositories get 50 GB of always-free storage, 500 GB per month of free anonymous data transfer out, and 5 TB per month when the puller uses an AWS account
• Cross-region and cross-account replication, repository creation templates, and managed image signing are all built in

Cons

• Private free tier is only 500 MB per month and expires after 12 months, unlike the always-free public allowance
• Data transfer out to the internet or to another region is charged at standard AWS rates, $0.09 per GB in AWS's own worked example, and is charged on both sides of a cross-region transfer
• Enhanced scanning is a separate Amazon Inspector charge: $0.09 per initial image scan and $0.01 per rescan, and continuous rescanning of a large repository adds up quickly
• Pricing is genuinely multi-dimensional (storage, transfer, scanning, signing, replication), which makes a single monthly estimate hard
• Strong lock-in to AWS identity and networking, which is the flip side of the free in-region pulls

Pros

• Free storage allowance of 0.5 GiB-month, then a flat $0.10 per GiB-month with no tier to choose
• Data moving within the same location is free, so a correctly co-located repository has effectively no egress cost for in-region pulls
• One product for container images and language packages (Maven, npm, Python, Go), which removes a separate artifact repository for many teams
• Remote repositories cache upstream registries and virtual repositories present several backends as one endpoint, which covers both the rate-limit and the consolidation use cases
• Pricing applies at billing account level, so the free allowance pools across all attached projects

Cons

• Vulnerability scanning is not included: Artifact Analysis is billed separately, and the rate is not stated on the Artifact Registry pricing page itself
• Cross-region and intercontinental egress adds up: $0.01 per GiB between US and Canada regions, $0.05 per GiB within Asia, and $0.15 per GiB to or from Oceania
• The free allowance is tiny at 0.5 GiB-month, which is a rounding error for any real container estate
• Enabling the Container Scanning API turns on and bills scanning for both Artifact Registry and the legacy Container Registry together, which surprises teams mid-migration
• Little reason to choose it if your compute is not on Google Cloud, since the location-based free egress is the whole advantage

Pros

• Genuinely predictable pricing: a fixed daily registry unit rate plus included storage, rather than metering every dimension
• Included storage is generous relative to the fee: 10 GB on Basic, 100 GB on Standard, 500 GB on Premium
• Overage is a flat $0.10 per GB-month at every tier, so exceeding the included amount is not a cliff
• Premium adds geo-replication and connected registries, which handle multi-region and edge or disconnected scenarios properly
• ACR Tasks builds images in the registry, billed per CPU second, with a free allowance before charges begin

Cons

• Geo-replication is Premium-only and each replica is billed as an additional Premium registry replication unit at the same daily rate as the registry itself
• Webhook limits are tight on the lower tiers: 2 on Basic and 10 on Standard, against 500 on Premium
• Vulnerability scanning is not included; it comes from Microsoft Defender for Containers as a separate purchase
• Connected registry, used for edge and disconnected deployments, is a further per-day charge on top of Premium
• Prices vary by region and currency and are only shown through the Azure calculator, so a quoted figure is always region-specific

Pros

• CNCF Graduated since 15 June 2020, with open governance rather than a single vendor's roadmap
• Trivy vulnerability scanning is built in with no per-image or per-scan charge, which is a real saving against Inspector's $0.09 plus $0.01 per rescan model
• Proxy cache absorbs upstream rate limits permanently, so Docker Hub's 100 or 200 pulls per 6 hours stops being an operational concern
• Tag retention policies, immutability rules, replication between registries, and project-level RBAC are all first-class
• Runs entirely inside your network, which is the only workable answer for air-gapped and some regulated environments
• Supports OCI artifacts and Helm charts, not just container images

Cons

• You operate it: Harbor's own prerequisites are 2 CPU, 4 GB RAM, and 40 GB disk minimum, with 4 CPU, 8 GB, and 160 GB recommended, before any image storage
• It is a multi-component system (PostgreSQL, Redis, the Distribution registry, the Harbor core) and each component is your responsibility to patch and back up
• High availability, certificate management, and storage backend configuration are all design work you must do before production
• Upgrades require care because the database schema changes between minor versions
• No vendor to call, so the standing cost is the engineer who knows how it works and the documentation they leave behind

Pros

• The default registry for the entire ecosystem, so Docker Official Images and Verified Publisher images are here first and everywhere else second
• Authenticated Pro, Team, and Business subscribers get an unlimited pull rate, subject to fair use, which resolves the limit entirely for paying customers
• Docker cancelled the planned image pull consumption fees and did not enforce the stricter hourly limits scheduled for 1 April 2025
• Storage-based billing is indefinitely delayed, with Docker committing to at least six months notice before introducing it
• Docker Scout provides health scores, local vulnerability analysis, and remediation guidance, included at some level on every plan
• Pull rate headers are exposed on the registry API, so you can measure your own consumption before it bites

Cons

• Unauthenticated pulls are limited to 100 per 6 hours per IPv4 address or IPv6 /64 subnet, which is a shared pool on any NAT, CI runner fleet, or corporate network
• Personal accounts get only 200 pulls per 6 hours and 1 private repository
• Docker's own pricing page and its documentation disagree: the pricing page shows 100 pulls per hour for Personal, while the documentation specifies 200 per 6 hours, so the authoritative figure is the documented one
• A multi-architecture image counts as one pull per architecture pulled, which silently doubles consumption for teams building for amd64 and arm64
• Third-party CI platforms often share IP ranges, so an authenticated pull can still hit abuse rate limiting attributed to the shared address
• Docker Scout is limited to 1 repository on Personal and 2 on Pro, so scanning at any scale needs Team or Business

Pros

• Images inherit project and group permissions, so there is no second access control system to keep in sync
• GitLab CI pushes and pulls without configuring separate registry credentials, which removes a common source of pipeline breakage
• Self-managed GitLab includes the registry, so a private in-network registry comes with a product the organisation already runs
• Cleanup policies for tags are configurable per project, so retention is enforceable
• Container scanning is available in the Ultimate tier as part of the same pipeline rather than a separate tool

Cons

• GitLab's documentation publishes no container registry specific storage quota and no pull rate limit, which makes cost and capacity planning harder than on any cloud registry here
• Registry storage counts against namespace storage, and additional storage is an add-on at $5 per month per 10 GiB billed annually on Premium and Ultimate
• Container scanning requires Ultimate, whose price is not published at all
• Premium is $29 per user per month billed annually, so if you are not already a GitLab customer the registry is an expensive way in
• Little advantage for teams whose source lives elsewhere, since the integration is the whole value

Pros

• One repository for container images and essentially every language package format, which is the real reason large organisations buy it
• Remote repositories proxy and cache upstream registries, solving Docker Hub rate limiting the same way Harbor's proxy cache does
• Replication, access control, and retention policies apply uniformly across all artifact types rather than per tool
• JFrog Xray adds binary-level vulnerability and licence compliance scanning across every repository type, sold separately
• Available both as a cloud subscription and self-managed, including air-gapped deployments

Cons

• Pricing could not be read from JFrog's own pages this session: the pricing and buy-now pages returned bot challenges or empty content to automated fetching, so no number here is sourced to a JFrog page
• Consumption-based model across storage and data transfer, with tiered discounts by storage volume, which is harder to forecast than a flat per-GB rate
• Xray and Advanced Security are separate line items, so the security posture most buyers want is not in the base price
• Substantially over-specified if the requirement is container images alone: the other seven options here are cheaper and simpler for that job
• Self-managed deployment carries an operational burden comparable to Harbor, without Harbor's zero licence cost