An artifact registry is the store where a software team keeps every built version of its software, ready to deploy, and where each version is scanned for known flaws. An artifact is anything a build produces, such as a container image, a mobile app file or a Java package. The registry is also called an artifact repository, or a container registry when it holds only container images. A container image is one file that holds a program and everything it needs to run.
Why keep built versions, when the code is already in the code repository? Because building takes time, and two builds of the same code are not always identical. So the CI/CD pipeline builds each version once and stores it. Testing, staging and production then all use exactly that stored file. Each version has a fixed name and number, such as "tracking-api:2.14.3", and it is never changed after it is stored.
The registry does a second job. Most software is built largely from open-source libraries, free code that other people write and publish on public websites. During a build, the pipeline downloads hundreds of them. The registry keeps a local copy of each library. So builds still work when a public website is down, and the security team can block a library it does not trust.
Here is a typical case. A logistics company in Ahmedabad runs a parcel-tracking service. Its pipeline builds version 2.14.3 of the service as a 180 MB container image, and sends it to the registry. The registry scans the image and finds an image-processing library with a known flaw. The flaw is listed as a CVE, a public, numbered entry for a known security weakness, and it is rated critical. The registry marks version 2.14.3 as blocked, so it cannot be deployed. A developer updates the library, the pipeline builds 2.14.4, and that version passes the scan and goes live.
A week later, version 2.15.0 makes the service slow. The team tells the Kubernetes platform, which runs the service's containers, to go back to 2.14.4. It collects that image from the registry, and the service is back to normal in five minutes. Going back to an earlier version like this is called a rollback.
The registry works with two scanners. Software composition analysis (SCA) lists every library inside each artifact. Container image scanning inspects the whole image, including the operating system files packed inside it. Developers also collect images from the registry on their own laptops, with Docker and container developer tools.