It depends on the registry. Harbor combines rules with OR, so an image kept by any rule is kept. Amazon ECR applies rules by priority, with each image matched by at most one rule. Google Artifact Registry keeps an artifact that matches both a delete and a keep policy.
Why this matters
Teams often write several rules, one per tag class. If you assume the wrong combination logic, a rule you meant as a safety net can become the thing that deletes your release.
Three models side by side
| Registry | How overlaps resolve | Practical effect |
|---|---|---|
| Harbor | Rules run together and results are combined with OR | More rules can only keep more |
| Amazon ECR | All rules evaluated, then applied by priority number, lower number first | An image is expired by exactly one rule or none |
| Google Artifact Registry | A match in a keep policy wins over a delete policy | Keep policies are a safety layer |
Harbor in detail
Harbor documents that its rules say which tags to retain, and anything not retained is discarded. With multiple rules, no rule has priority, they run concurrently, and the resulting sets are combined. It also notes that if an artifact has several tags and only some match a rule, the artifact and all its tags are retained, since retention is matched on tags but carried out on artifacts. A project can hold up to 15 rules per the Harbor page.
ECR in detail
ECR documents that all rules are evaluated at once, then applied by priority. An image that matches the tagging requirements of a rule cannot be expired by a rule with a lower priority. It also says that a rule may use a tag pattern list or a tag prefix list but not both, and that wildcard use is limited to four per string. These details cause silent mismatches, so use the preview.
Artifact Registry in detail
Artifact Registry says that if you have artifacts you do not want deleted, create a conditional keep policy or a most recent versions keep policy alongside a delete policy, and a match in both means the artifact is kept. It also supports a dry run, with changes taking effect in about a day.
How to design for any of them
- Write each rule as one sentence: what it keeps or removes and why.
- Assume an image can match more than one rule and predict the outcome under your registry's model.
- Use the preview to confirm the prediction.
- Add one test image per class and watch that it behaves as expected.
If you move between registries, rewrite the policy rather than translating it line by line, because the same rules produce different outcomes under OR logic and priority logic.
Related reading
For protected classes, see which images a retention policy should never delete. For a rollout order, see a registry cleanup dry run checklist.
Quick check
Is more rules always safer?
Not always. Under priority logic, a higher priority rule can mark images you expected a later rule to protect. Test with a preview.
What if two tags point at one image?
In Harbor, the image and all its tags are retained if any tag matches a retention rule. Check your own registry's behaviour.
Sources
Last reviewed: 19 October 2026.
