> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cybedefend.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Google Container Registry

> Scan container images stored in Google Container Registry.

**Google Container Registry (GCR)** is Google Cloud's managed Docker registry service. CybeDefend integrates with GCR to scan your container images using service account authentication.

## CybeDefend Configuration

| Field                          | Description                              | Example                            |
| ------------------------------ | ---------------------------------------- | ---------------------------------- |
| **GCP Project ID**             | Your Google Cloud project ID             | `my-gcp-project-123`               |
| **Registry Hostname**          | GCR hostname for your region             | `gcr.io (Global/US)`               |
| **Service Account Key (JSON)** | Full JSON content of service account key | `{"type": "service_account", ...}` |

### Available Registry Hostnames

| Hostname      | Region                 |
| ------------- | ---------------------- |
| `gcr.io`      | Global / United States |
| `us.gcr.io`   | United States          |
| `eu.gcr.io`   | Europe                 |
| `asia.gcr.io` | Asia                   |

## How to Create a Service Account Key in GCP

<Steps>
  <Step title="Access GCP Console">
    Go to GCP Console → **IAM & Admin** → **Service Accounts**
  </Step>

  <Step title="Create or Select Account">
    Create a new service account or select an existing one
  </Step>

  <Step title="Assign Role">
    Grant the role **Storage Object Viewer** (read access) or **Storage Admin** (read/write)
  </Step>

  <Step title="Create Key">
    Create a new key in **JSON format** and download it
  </Step>

  <Step title="Paste JSON Content">
    Paste the complete JSON content in CybeDefend
  </Step>
</Steps>

<Warning>
  The service account key JSON file contains sensitive credentials. Store it securely and never commit it to version control.
</Warning>

## Security Best Practices

<CardGroup cols={2}>
  <Card title="Least Privilege" icon="shield-halved">
    Use `Storage Object Viewer` role for read-only access to images.
  </Card>

  <Card title="Rotate Keys" icon="rotate">
    Rotate service account keys regularly to minimize security risks.
  </Card>

  <Card title="Use Workload Identity" icon="google">
    Prefer Workload Identity over service account keys when possible.
  </Card>

  <Card title="Audit Access" icon="chart-line">
    Enable Cloud Audit Logs for monitoring and compliance.
  </Card>
</CardGroup>

## Troubleshooting

<AccordionGroup>
  <Accordion title="Authentication Failed" icon="circle-exclamation">
    * Verify the JSON key is valid and complete
    * Check if the service account has been deleted or disabled
    * Ensure the project ID matches your registry
  </Accordion>

  <Accordion title="Permission Denied" icon="ban">
    * Verify the service account has `Storage Object Viewer` role
    * Check if Container Registry API is enabled
  </Accordion>
</AccordionGroup>