Software container registry service

1. A computer implemented method, comprising:

receiving, from an entity associated with a customer account with a computing resource service provider, a request to update a software container image within a container registry hosted by the computing resource service provider, the software container image including image layers stored as encrypted image layers in a data object store assigned to the customer account, the container registry being a scalable distributed data storage service;

storing, in the container registry, the software container image in association with the customer account;

scanning a layer of the software container image stored in the container registry for a reference identifier associated with a security vulnerability;

as a result of said scanning finding the reference identifier within the software container image, providing notice to the entity indicating that the security vulnerability was found;

updating the software container image based at least in part on the result of said scanning; and

deploying the updated software container image.

2. The computer implemented method of claim 1 , further comprising deleting the software container image from the container registry.

3. The computer implemented method of claim 1 , wherein an encryption key for encrypting the software container image is managed by the entity associated with the customer account.

4. The computer implemented method of claim 1 , further comprising obtaining an instruction that specifies, on a condition that the security vulnerability is found, to perform a rollback of the software container image.

5. The computer implemented method of claim 1 , further comprising storing, in a registry metadata service, metadata about the software container image.

6. The computer implemented method of claim 5 , wherein the registry metadata service is a structured data storage service.

7. The computer implemented method of claim 1 , wherein the layer of the software container image corresponds to a step in a build process of the software container image.

8. A system, comprising:

one or more processors; and

memory including executable instructions that, as a result of execution by the one or more processors, cause the system to:

receive, from an entity associated with a customer account with a computing resource service provider, a request to update a software container image within a container registry hosted by the computing resource service provider, the container registry being a scalable distributed data storage service;

store, in the container registry, the software container image in association with the customer account by at least causing the system to:

encrypt the software container image to produce an encrypted software container image; and

store the encrypted software container image in association with the customer account;

scan a layer of the software container image stored in the container registry for a reference identifier associated with a security vulnerability;

as a result of said scan finding the reference identifier within the software container image, providing notice to the entity indicating that the security vulnerability was found;

update the software container image based at least in part on the result of said scan; and

deploy the updated software container image.

9. The system of claim 8 , wherein the executable instructions further include instructions that cause the system to obtain a manifest that contains metadata about a set of container image layers comprising the software container image stored in the container registry.

10. The system of claim 8 , wherein the executable instructions further include instructions that cause the system to:

receive a user-specified tag to apply to the software container image; and

apply the user-specified tag to the software container image stored in the container registry.

11. The system of claim 8 , wherein the executable instructions that cause the system to update the software container image include instructions that cause the system to update the software container image in response to receipt of updated software without the security vulnerability from the entity.

12. The system of claim 8 , wherein the software container image comprises image layers stored as encrypted image layers in a data object assigned to the customer account.

13. A non-transitory computer-readable storage medium having stored thereon executable instructions that, as a result of being executed by a processor of a computer system, cause the computer system to at least:

receive, from an entity associated with a customer account with a computing resource service provider, a request to update a software container image within a container registry hosted by the computing resource service provider, the software container image including image layers stored as encrypted image layers in a data object store assigned to the customer account, the container registry being a scalable distributed data storage service;

store, in the container registry, the software container image in association with the customer account;

scan a layer of the software container image stored in the container registry for a reference identifier associated with a security vulnerability;

as a result of said scan finding the reference identifier within the software container image, providing notice to the entity indicating that the security vulnerability was found;

update the software container image based at least in part on the result of said scan; and

deploy the updated software container image.

14. The non-transitory computer-readable storage medium of claim 13 , wherein the executable instructions further include instructions that cause the computer system to store, in a registry metadata service, metadata about the software container image.

15. The non-transitory computer-readable storage medium of claim 14 , wherein the registry metadata service is a structured data storage service.

16. The non-transitory computer-readable storage medium of claim 13 , wherein the executable instructions further include instructions that cause the computer system to:

receiving a command to deploy a software application that is based at least in part on the software container image; and

deploying, based at least in part on the software container image stored in the container registry, the software application using a cluster of container instances.

17. The non-transitory computer-readable storage medium of claim 16 , wherein the cluster of container instances is associated with the customer account.

18. The non-transitory computer-readable storage medium of claim 16 , wherein the executable instructions that cause the computer system to deploy the software application further include instructions that cause the computer system to deploy the software application in response to a command received via an application programming interface.

19. The non-transitory computer-readable storage medium of claim 16 , wherein the executable instructions further include instructions that cause the computer system, prior to updating the software container image, to roll back the software application using a previous version of the software container image stored in the container registry.

20. The non-transitory computer-readable storage medium of claim 16 , wherein the executable instructions that cause the computer system to deploy the updated software container image further include instructions that cause the computer system to redeploy the software application using the updated software container image.