Amazon ECR
Amazon ECR is AWS's fully managed Docker/OCI container registry, tightly integrated with IAM, ECS, EKS, Fargate, and CodeBuild — no separate credential system needed. Private-repository storage costs a flat $0.10/GB/month; public repositories store free with a 50 GB/month always-free allowance. New accounts get 500 MB/month of private storage free for their first 12 months. Data transfer into AWS compute in the same region is free; public-repo pulls get 500 GB/month free anonymously or 5 TB/month authenticated. JSON-defined lifecycle policies auto-expire untagged or aged images to cap storage spend, and basic vulnerability scanning runs free on every image push, with deeper CVE coverage available through paid Amazon Inspector integration. License: proprietary SaaS (AWS managed service). Pricing: Private storage $0.10/GB/month (500 MB/month free for new accounts' first 12 months); public repos store free with a 50 GB/month allowance and 500 GB/month (anonymous) or 5 TB/month (authenticated) free egress; same-region transfer to AWS compute is free. Maintained by Amazon Web Services (AWS).
Amazon ECR is the natural private registry when AWS runs the workload, but it is still a storage-and-transfer service. Keep only the images you deploy, understand the pull path, and avoid treating tag accumulation as harmless.
Pick ECR when you're already deploying on ECS, EKS, or Fargate — IAM-native auth means zero extra secrets to rotate, and same-region pulls to AWS compute are free, which Docker Hub and GHCR can't match once you factor egress. Skip it for public open-source distribution: Docker Hub's discoverability and GHCR's free-for-public storage beat ECR's private-by-default, AWS-account-gated model for reaching outside contributors. AWS doesn't publish per-registry SLA numbers beyond its general ECR service commitment, and multi-cloud shops resent that ECR's IAM policies and pricing don't travel — Harbor's self-hosted, cloud-agnostic model exists specifically to solve that lock-in. Known weakness: Access is entirely IAM-gated, so multi-cloud or on-prem pipelines need extra federation/credential tooling that vendor-neutral options like GHCR or self-hosted Harbor don't require.