Question

A software company is designing the CI/CD foundation for a greenfield migration to Google Cloud. Their build pipeline produces both Docker container images and language-specific packages (Maven and npm). Compliance requires that every artifact be scanned for known vulnerabilities before deployment and that deployments be blocked if an image contains a critical CVE. They want a single Google-managed service that stores all artifact types and integrates natively with vulnerability scanning and admission control. Which design should the architect recommend?

Accepted Answer

Store images and packages in Artifact Registry, enable Artifact Analysis (Container Scanning API), and enforce Binary Authorization policies in the deployment cluster.

Answer

Store images in Container Registry (gcr.io), keep Maven and npm packages in a self-managed Nexus VM, and run a nightly Cloud Function that scans images.

Answer

Store all artifacts in a Cloud Storage bucket with object versioning, and use a Cloud Build step that runs a third-party scanner before uploading.

Answer

Store images in Artifact Registry and use Cloud Armor security policies to block deployment of images that contain critical vulnerabilities.