A bill can outpace object storage long before your image footprint looks large. Builds add layers, metadata, replication traffic, API calls, and retention liabilities. Logs, caches, reports, and pull-request bundles add more cost.
Container Registry Costs vs Object Storage for CI/CD Artifacts: Registries usually suit production OCI images. Object storage is often cheaper for large, short-lived CI/CD artifacts, logs, caches, and generic outputs. The real choice depends on egress, requests, replication, retention, deduplication, build frequency, and operational overhead.
What actually drives CI/CD artifact cost
Separate production images, pull-request artifacts, caches, logs, and backups before pricing them. Each has different download frequency, recovery value, and retention needs.
Storage and retention multiply quietly
A pipeline retaining 20 GB daily for 30 days holds roughly 600 GB before replicas. At about $0.10 per GB-month in a registry, that costs about $60. At roughly $0.023 in S3 Standard, it costs about $13.80.
Retention must match recovery value. A pull-request report may be disposable after 14 days. A production image digest may need 90 days or several years. That supports rollback, audits, support, or incident investigation.
Applying one rule to every artifact is a common and dangerous mistake.
Egress and requests change the answer
A 2 GB image pulled 100 times outside its home region moves 200 GB. Internet transfer near $0.09 per GB can add about $18 before taxes. Object storage also bills PUT, GET, and LIST operations in many setups.
Millions of small cache keys can create a noisy bill. This can happen even when stored capacity is inexpensive.
Keep runners, storage, and deployment targets in the same region whenever possible. Repeated cross-region downloads often surprise teams more than monthly storage charges.
Replication and rebuilds have a price
Cross-region replication can create a second stored copy. It can also add inter-region transfer charges. Use it for a real uptime, recovery, or locality need.
Rebuild cost matters too. Keeping a result for another week can cost less than recreating a 15-minute build. This matters with expensive runners, private dependencies, or long test suites.
Storage is predictable. Repeated remote downloads, needless replicas, and avoidable rebuilds often turn a modest CI/CD bill into a surprise.
Use a monthly total-cost model, not a storage-only comparison. Total cost includes retained bytes, image egress, replication transfer, duplicate copies, API requests, rebuild compute, and support time.
Track retention separately for release images, build caches, and pipeline logs. Deleting 40% of disposable data cuts the storage portion by roughly 40%. It does not cut pull traffic or request volume.
Artifact lifecycle policies should target known-safe prefixes and repositories first. Registry retention must protect digests referenced by deployment manifests. Generic archives can expire by build age after a tested rollback window.
Choose separate policies if your artifacts have different recovery value.
Registry vs object storage: cost table
These figures use common published US list prices as planning references. Verify current AWS, Google Cloud, and Azure rates by region, tier, and contract.
| Measured factor | Container registry example | Object storage example | Cost effect |
|---|
| US storage rate | ECR private images: about $0.10/GB-month | S3 Standard: about $0.023/GB-month | Object storage saves about 77% on raw stored GB |
| 2 TB retained for 30 days | About $200 before transfers | About $46 before requests | About $154 monthly gap for generic files |
| OCI pull workflow | Native tags, manifests, auth, digest pulls | Needs custom download and unpack flow | Registry reduces deployment work |
| 100,000 small reads | Often bundled into registry behavior | S3 GETs: about $0.04 | Request cost stays low until reads reach millions |
| Remote 1 TB internet download | May approach $90 at $0.09/GB | May approach $90 at $0.09/GB | Egress can erase storage savings |
| Lifecycle control | Tag and digest rules need deployment checks | Age and storage-class rules are flexible | Object storage suits temporary output |
Registry pricing can make sense for a 600 MB production image. Its manifests, immutable tags, private access control, vulnerability scanning, and Kubernetes support can prevent failed deployments. It can also simplify rollback.
Object storage wins when the file is not an OCI artifact. Browser-test video, installers, compressed logs, report archives, and database exports gain little from registry tags.
A registry is cheaper only when its deployment controls save more time or risk than its higher storage rate.
A direct choice for large Docker images
Large Docker images belong in a registry when they deploy as images. Kubernetes and Docker expect a standard OCI endpoint. That endpoint handles authentication, manifests, digests, and image pulls.
Moving images to S3, Google Cloud Storage, or Azure Blob Storage needs another registry layer. It may also need custom download logic. Large non-image bundles belong in object storage.
Build archives, static sites, screenshots, coverage reports, package caches, and exports usually benefit from lower storage prices. They also get clearer lifecycle controls.
Published list rates are only a starting point. Provider plans and billing boundaries can change the comparison.
Amazon ECR pricing often uses a per-GB private-image rate. Teams should also check regional availability and introductory allowances. Check replication charges and enhanced scanning costs too.
Amazon S3 Standard prices stored capacity separately from request and transfer charges. A Docker image registry included with CI may bundle limited storage or transfer. An enterprise plan may move some cost into seat-based subscriptions.
Compare marginal cost after included capacity ends, not the headline GB-month rate.
Keep OCI release images in a registry
A registry is the reliable home for release-grade Docker images. Tags, manifests, digests, and layers let deployment tools request the exact package.
Pros
OCI registries support native pulls for Docker, Kubernetes, and delivery tools. They support digest pinning for rollback, IAM, access control, vulnerability scanning, immutable releases, and regional replication.
Layer deduplication can cut storage when images share identical compressed layers. Teams should verify account, repository, and region boundaries before budgeting for those savings.
Stable Dockerfile order and repeatable builds improve layer reuse. Changing package indexes, timestamps, or base-image digests can create separately billed layers.
Cons
Registries can cost several times more per GB than standard object storage. Their benefits vanish for logs, ZIP files, test exports, and backups. No runtime pulls those files as images.
Cross-region pulls and replication can exceed storage charges. A registry becomes risky when it acts as a general-purpose dumping ground. Deployable releases and disposable output can look equally important.
Separate repositories and lifecycle policies are essential. This is most vital when temporary builds share an account with production images.
Use a registry for production images, signed releases, OCI-based Helm artifacts, and promoted images. Amazon ECR, Google Artifact Registry, Azure Container Registry, GitHub Packages, GitLab Container Registry, Docker Hub, and JFrog Artifactory differ in controls. Their workload fit remains consistent.
Do not use a registry for bulky test evidence or short-lived build output. Choose this if: you deploy OCI images to Kubernetes or servers and need native pulls, digest-based rollback, and controlled promotion.
A secure registry setup affects operating cost and reliability. Configure CI jobs with short-lived OIDC-issued credentials, not long-lived access keys. Let builders push only to build repositories.
Give deployment identities pull-only access to approved release repositories. Enable immutable release tags and require digest-based promotion. Keep vulnerability-scan or signature checks in the promotion path.
For OCI image pulls, limit network access where private endpoints exist. Record the deployed digest in the release system. These controls make registry costs easier to audit.
They also reduce the risk of overwritten production tags.
Put generic pipeline outputs in object storage
Object storage is built for files needing a durable address and low storage cost. It also supports temporary access and flexible expiration. It does not provide container-runtime image pulls.
Pros
Amazon S3, Google Cloud Storage, Azure Blob Storage, and Cloudflare R2 fit many pipeline outputs. These include JUnit XML, reports, installers, archives, logs, screenshots, SBOM exports, backups, and test media.
Standard storage commonly costs between $0.018 and $0.026 per GB-month in major US regions. Lifecycle rules can delete branch files after 7, 14, or 30 days. This does not affect release images.
Presigned URLs give limited access. Archive classes can lower costs when retrieval delays are acceptable.
Cons
Object storage can bill GET, PUT, LIST, retrieval, and early deletion. It is not always cheaper for millions of small cache objects. Cold tiers can add delays or retrieval charges.
A bucket does not provide an OCI registry API for Docker or Kubernetes. Poor key naming can weaken links between artifacts, commits, builds, and releases.
Avoid archive tiers for files needed during normal deployment or rollback. Fast access is often worth more than a small per-GB saving.
Use object storage for non-OCI pipeline outputs. Keep high-read caches close to runners when saved compute exceeds storage and request cost. Do not rely on object storage alone for runtime images.
A supported registry front end is required for runtime images. Homemade image-download scripts move authentication, integrity checks, tag handling, and recovery work onto your team. Choose this if: your pipeline creates large non-OCI files, you can set clear expiry rules, and downloads happen near the bucket.
A practical artifact path for most teams
Build output
Image, log, report, cache, archive
→
OCI image?
Needs Docker or Kubernetes pull
→
Yes: registry; No: object storage
Digest, scan, promote, or set expiry rules
Cost scenarios for growing CI/CD teams
Usage patterns reveal the real winner better than a single storage price.
Frequent builds with short retention
For 100 daily builds, assume a 500 MB test archive and 700 MB image. Fourteen-day retention creates about 684 GB of archives. It also creates 957 GB of images before compression and layer sharing.
Storing all 1,641 GB in a registry costs about $164 at $0.10 per GB-month. Putting archives in object storage costs about $112 before deduplication. That uses $0.023 for archives and retains images in the registry.
This is the standard hybrid case. Generic, disposable archives belong in object storage. Images retain registry behavior.
Many environments and rollback windows
Promote the same immutable image digest through development, staging, production, and disaster recovery. Do not rebuild it for each environment. Rebuilding loses layer reuse and makes incident diagnosis harder.
Keep protected production images for a defined rollback period. This is commonly between 30 and 180 days. Record active digests before lifecycle policies remove untagged content.
Keeping every branch image for a year is not protection. Deployment records and tested grace periods give safer, cheaper retention.
Remote runners and regional delivery
Runners may build in Virginia while artifacts live in Oregon. California clusters may pull them again. The same bytes can cross regions several times.
Place runners and high-read caches together. Create registry replicas only when production latency, local recovery, or uptime targets justify duplicate storage.
For heavy parallel builds, object storage usually handles generic file volume better. A registry handles deployable image concurrency better when nodes pull locally.
Avoid cleanup rules that break rollbacks
Lifecycle management should remove material with no recovery value. It must protect content required by active workloads, release records, and disaster plans.
Safe retention rules
Use separate prefixes, repositories, or namespaces for pull-request output, releases, logs, caches, and backups. Each category can then have its own expiry rule.
A practical policy can delete pull-request logs after 14 days. It can retain release artifacts for 90 days. It can preserve production images for 180 days.
Keep security evidence based on documented obligations.
Do not delete by tag age alone. Tags can move or disappear, while workloads usually reference immutable digests. Test policies against an inventory before enabling deletion.
Protect digests referenced by active manifests.
Verify layer sharing before budgeting
Confirm whether deduplication works across repositories, projects, accounts, or only one repository. Provider behavior differs. Do this before you budget for shared layers.
Keep stable instructions near the start of Dockerfiles. Put changing application code near the end. Pin base images by digest when repeatability matters.
Do not assume similar Dockerfiles share billed layers. Changed apt indexes, timestamps, compression output, or base-image content can make layers distinct.
This comparison matters less for small pipelines with low artifact volume. It also matters less with one region and little egress. Managed CI plans may already include enough registry and artifact storage. Do not replace a required registry when compliance, immutability, supply-chain controls, or security policy mandates a specific service.
Frequently asked questions
Is a container registry cheaper than S3 for CI/CD artifacts?
Usually not for generic files. ECR private storage commonly lists around $0.10 per GB-month. S3 Standard commonly lists around $0.023 in US regions.
A registry can still justify its premium for deployable OCI images. It avoids custom pull, integrity, and release-management work.
When do egress fees make registries expensive?
Egress becomes expensive when remote runners, developer machines, or clusters pull from another region or the internet. A 1 TB monthly internet transfer at roughly $0.09 per GB can approach $90. That can exceed storage charges for several terabytes.
Is object storage faster for CI caches?
It can be faster when runners and buckets share a region and cache hit rates are high. It can be slower when jobs download thousands of small objects or unpack large archives. Measure cold and warm cache performance across 20 to 50 builds.
Can I delete untagged container images safely?
Not without checking digest references first. An untagged digest may support a running Kubernetes workload, rollback manifest, or disaster-recovery environment. Protect active digests before automating deletion.
Which choice fits your situation
Choose a hybrid design unless a clear constraint says otherwise. Keep production OCI images in a registry for native pulls, digest control, scanning, access rules, promotion, and Kubernetes support.
Put logs, reports, archives, backups, and short-lived generic artifacts in object storage. This lowers retention cost and makes expiry rules simpler.
Registry-only storage fits small artifact volumes or bundled managed-CI capacity. Object-storage-heavy pipelines fit large, short-lived non-image output.
The decisive recommendation is simple: pay registry pricing for deployable images. Pay object-storage pricing for everything that is only a file.
