The container registry is one of the least visible parts of a Node.js SaaS architecture — until it fails.
A normal deployment depends on a fragile chain:
Git commit
└─► CI
├─► npm install
├─► build TypeScript
├─► build container
├─► generate SBOM
└─► sign artifact
└─► artifact registry
└─► production runtimeIf the registry is unavailable, deployments stop. If an image tag is overwritten, rollback becomes ambiguous. If a compromised CI credential can publish a malicious image, the registry becomes part of the software supply-chain attack path. If production pulls node:latest directly from a public registry, an external outage or rate limit can become a production scaling incident.
For Node.js SaaS teams in 2026, six strong options stand out: GitHub Container Registry / GitHub Packages, Amazon Elastic Container Registry (ECR), Google Artifact Registry, Azure Container Registry (ACR), Cloudsmith, and JFrog Artifactory.
The key question is simple: is your registry mainly a cloud-local container store, or is it the system of record for your complete software supply chain?
Quick Recommendation
Choose GitHub Container Registry (GHCR) when source code, CI/CD, permissions, and developer workflows already live in GitHub. GitHub’s current billing documentation still says container-image storage and bandwidth in the Container registry are free. GitHub Packages also supports private npm packages, although generic package billing differs from the current GHCR container policy.
Choose Amazon ECR when AWS owns the runtime. Private registry storage currently costs about $0.10/GB-month in AWS’s published examples, pulls from ECR to AWS compute in the same Region do not incur data-transfer charges, and ECR now has stronger pull-through caching, OCI referrer synchronization, cross-repository layer sharing, lifecycle policy, and scanning capabilities.
Choose Google Artifact Registry when GCP is the runtime or when you want one cloud-native service for both Docker/OCI images and language packages such as npm. Artifact Registry currently includes the first 0.5 GiB-month of storage, then charges roughly $0.10/GiB-month at the published hourly rate.
Choose Azure Container Registry (ACR) when AKS, Container Apps, App Service, or other Azure runtimes dominate your stack. Basic, Standard, and Premium currently include 10, 100, and 500 GiB respectively; Premium adds geo-replication, Private Link, connected registries, and higher scale limits.
Choose Cloudsmith when your Node.js platform needs a cloud-native universal registry for containers and private npm packages without the full operational scope of a large enterprise Artifactory deployment. Current public pricing is straightforward: Core is free; Pro is $149/month with 5 GB artifact data and 25 GB delivery.
Choose JFrog Artifactory when the registry is becoming an enterprise software-supply-chain system of record. Artifactory supports containers, npm, Maven, PyPI, Helm, ML models, AI/agent packages, federation, and many repository types.
Container Registry vs Artifact Repository
A container registry primarily stores OCI/Docker images, manifests, layers, signatures, SBOMs, and attestations. A universal artifact repository also stores npm, Maven, PyPI, NuGet, Helm, Go modules, raw binaries, and increasingly ML/AI assets.
For a Node.js SaaS, this distinction matters because you often ship two kinds of internal software:
container image + private npm packagesIf one platform can govern both, permissions and provenance become simpler.
Recommended Node.js Supply-Chain Architecture
Git repository
└─► CI workflow
├─► npm ci from trusted/proxied registry
├─► tests
├─► private npm package build
├─► container build
├─► SBOM
├─► provenance attestation
└─► signature
└─► artifact registry
├─► private npm package
├─► OCI image
├─► signature
├─► SBOM
└─► provenance
└─► policy gate
├─► vulnerability
├─► malware
├─► license
└─► signature
└─► production deployment by digestThe core principle is: build once, promote the same immutable artifact.
2026 Comparison
| Platform | Best For | 2026 Pricing Signal | Containers | Private npm | Upstream Proxy / Cache |
|---|---|---|---|---|---|
| GitHub Container Registry / Packages | GitHub-native CI/CD | GHCR image storage/bandwidth currently free; generic Packages quotas vary by plan | Excellent | Yes | Limited vs universal registries |
| Amazon ECR | AWS-native container workloads | Private storage about $0.10/GB-month; same-Region AWS pulls $0 transfer | Excellent | No (use CodeArtifact) | Strong pull-through cache |
| Google Artifact Registry | GCP-native + multi-format | 0.5 GiB free, then about $0.10/GiB-month | Excellent | Yes | Remote, virtual, connector repositories |
| Azure Container Registry | Azure-native container workloads | Region/agreement dependent; 10/100/500 GiB included by tier | Excellent | No | Cloud-native cache/integration |
| Cloudsmith | Universal cloud-native registry | Core $0; Pro $149/mo | Excellent | Excellent | Strong upstream proxy/cache |
| JFrog Artifactory | Enterprise universal supply chain | Pro currently promoted at $50/mo with 25 GB consumption | Excellent | Excellent | Excellent remote repository/proxy model |
GitHub Container Registry
GHCR is difficult to beat for simplicity when source and CI already live in GitHub. GitHub’s current billing docs contain an unusually important note: container image storage and bandwidth for the Container registry are currently free. GitHub says customers will receive at least one month’s notice before that policy changes.
For generic private GitHub Packages, included quotas vary by plan. The current calculator lists overages of about $0.25/GB storage and $0.50/GB outbound transfer outside GitHub Actions.
The best workflow is to publish immutable image references such as:
ghcr.io/acme/billing-api@sha256:...instead of relying on latest.
GHCR is enough for many SaaS teams. A universal registry becomes more attractive when you need extensive upstream proxying, package federation, multi-format governance, or artifact policy independent from source control.
Amazon ECR
ECR is the natural registry for ECS, EKS, Fargate, Lambda container images, and AWS-native delivery pipelines.
AWS’s current public examples use about:
$0.10 / GB-monthfor private image storage. Transfer between ECR and AWS compute in the same Region is documented as free.
In 2026, ECR added several useful supply-chain features:
- Cross-repository layer sharing reuses common image layers between repositories, reducing duplicate storage and upload time.
- Pull-through cache gained OCI referrer discovery and synchronization so signatures, SBOMs, and attestations can follow cached images.
- ECR expanded upstream support, including Chainguard, and increased Docker-push layer limits to 200 GB in August 2026.
For ordinary Node.js SaaS services, keep images far smaller than that limit. A useful pattern is:
Docker Hub / Chainguard
└─► ECR pull-through cache
└─► ECS / EKSThis reduces direct runtime dependency on external registries.
Google Artifact Registry
Google Artifact Registry is the strongest cloud-native multi-format option in this comparison because it can host Docker/OCI plus npm and other package formats under one IAM model.
Current storage pricing:
- First 0.5 GiB-month: free
- Above 0.5 GiB-month: about $0.10/GiB-month
Co-locating the registry with GKE, Cloud Run, or Compute Engine can eliminate same-location transfer charges under documented cases.
Artifact Registry also has remote and virtual repository models for dependency control. In July 2026 Google added connector repositories, which proxy upstream requests without caching artifacts — useful when licensing or third-party policy prevents local caching but you still want one controlled, auditable endpoint.
Other 2026 updates include image prewarming, platform request logs, package fingerprints, and secret findings in Artifact Analysis.
Azure Container Registry
ACR is the natural choice for Azure-native container workloads. Current included storage:
| Tier | Included Storage |
|---|---|
| Basic | 10 GiB |
| Standard | 100 GiB |
| Premium | 500 GiB |
Premium adds geo-replication, Private Link, connected registry, and materially higher enterprise limits.
Azure’s exact dollar prices are dynamically rendered by region and agreement, so production cost estimates should use the live Azure calculator.
ACR is container-focused. If your Node.js platform also needs a universal private npm registry, pair it with Azure Artifacts, GitHub Packages, Cloudsmith, or JFrog.
Cloudsmith
Cloudsmith is a useful middle ground between a simple cloud container registry and a full enterprise Artifactory platform.
Current public pricing:
| Plan | Price | Artifact Data | Delivery |
|---|---|---|---|
| Core | $0/month | 500 MB | 1 GB |
| Pro | $149/month | 5 GB | 25 GB |
| Additional data | $1.50/GB | — | — |
Cloudsmith supports 30+ formats and can store Docker containers and npm packages in one platform. It also provides upstream proxy/cache capabilities and supply-chain policies for vulnerabilities, malware, and licensing.
For a Node.js team, a useful pattern is:
@acme/* → Cloudsmith private npm
public npm → Cloudsmith upstream proxy
Docker/OCI → same platformThat gives CI one governed dependency boundary.
JFrog Artifactory
Artifactory is the most expansive platform in this comparison. It supports containers, npm, Maven, PyPI, Helm, NuGet, Go, raw binaries, ML models, and many additional package technologies.
JFrog’s current pricing surfaces a $150/month list price for Pro together with a temporary $50/month promotional price. The current buy-now page says the promotion is available through June 4, 2027 and includes 25 GB of combined storage + transfer consumption.
Artifactory’s enterprise differentiators include remote repositories, artifact federation, advanced queryability, security integration, and multi-site distribution.
Its 2026 releases also show artifact management expanding beyond traditional software packages — Artifactory added repository support for agent plugins, skills, and Agent Packages containing prompts, hooks, MCP servers, instructions, and agent assets.
Supply-Chain Best Practices
Deploy Digests, Not latest
latest is a mutable pointer. If one replica restarts after a new image is pushed, you can end up with mixed versions without a deliberate deployment.
billing-api@sha256:...The digest is the artifact identity.
Build Once, Promote by Digest
# Bad
build staging image → test → rebuild production image → deploy
# Better
build digest A → test A → stage A → promote A → deploy AThe tested artifact is the deployed artifact.
Sign Images and Store SBOMs
Modern OCI registries can associate signatures, SBOMs, and provenance attestations with image digests. A production gate can require:
trusted signature + approved source provenance + vulnerability policy passesGenerate the SBOM during CI. When a new vulnerability appears, security can identify affected production images without rebuilding everything.
Proxy Docker Hub and Public npm
Direct dependency on public registries creates operational and security risk:
- Rate limits
- Upstream outages
- Package deletion
- Malicious replacements
- Dependency confusion
Use a controlled proxy/cache layer where the workload justifies it.
Separate Publisher and Runtime Permissions
CI needs push access. Production usually needs read-only pull access.
CI: push service-a
runtime: pull service-a
developers: read approved packages
release automation: promote/tag approved digestAvoid permanent registry credentials with write access to every production repository.
Lifecycle and Cleanup
Registries grow quickly. Keep:
- Deployed production digests
- Rollback releases
- Signed release artifacts
- Compliance-required history
Delete:
- Stale feature branch images
- Obsolete unreferenced layers
- Expired CI snapshots
Never delete artifacts purely by age without checking deployment references.
Region Placement
Registry location affects deploy speed, autoscaling, and cold starts. Keep registry and runtime close when possible.
Cloud Run us-central1 → Artifact Registry us-central1Avoid a cross-continent registry unless there is a deliberate requirement.
Scanner Cost Can Exceed Storage Cost
Container storage is cheap. Security scanning, replication, and transfer can cost more. Compare total cost:
registry + scanner + egress + replication + supportnot only the storage price.
Final Recommendation
For Node.js SaaS teams in 2026:
- GitHub Container Registry is the best low-friction option for GitHub-native teams, especially while container image storage and bandwidth remain free under the current policy.
- Amazon ECR is the best AWS-native choice, particularly with same-Region transfer economics, pull-through cache, cross-repository layer sharing, and OCI referrer support.
- Google Artifact Registry is the strongest cloud-native multi-format option because it can govern Docker images and private npm packages together.
- Azure Container Registry is the natural Azure-native choice, particularly Premium for private networking and geo-replication.
- Cloudsmith is the best fit for growing teams that want a dedicated cloud-native universal registry across npm, containers, and other formats.
- JFrog Artifactory is the strongest enterprise universal registry when artifact federation, many package types, supply-chain security, and organization-wide governance justify a dedicated platform.
The engineering rule is simple:
Do not treat your registry as a cache of things CI can always rebuild. Treat each production artifact as a signed, immutable release object.
Store its digest. Keep its SBOM and provenance. Control who can publish. Proxy untrusted upstream dependencies. Retain enough history to roll back. Deploy the exact artifact you tested.