Docker Hub & Registries
A registry stores images. Docker Hub is the default; in production almost everyone runs a private one (ECR, GCR, ACR, GHCR, Harbor). Tag, push, pull, sign.
Tag, push, pull, private registries
EXAMPLE
# 1) Tag for a registry
docker build -t me/app:1.4.0 .
docker tag me/app:1.4.0 ghcr.io/me/app:1.4.0
docker tag me/app:1.4.0 123456789012.dkr.ecr.us-east-1.amazonaws.com/app:1.4.0
# 2) Login
docker login # Docker Hub
docker login ghcr.io -u me -p $GHCR_TOKEN # GHCR
aws ecr get-login-password | docker login --username AWS --password-stdin \
123456789012.dkr.ecr.us-east-1.amazonaws.com # ECR
# 3) Push
docker push ghcr.io/me/app:1.4.0
# 4) Pull
docker pull ghcr.io/me/app:1.4.0
docker pull ghcr.io/me/app@sha256:abcdef… # by digest — immutable, reproducible
# 5) Inspect + delete
docker buildx imagetools inspect ghcr.io/me/app:1.4.0
# Most registries provide UI / CLI for delete + retention
# 6) Run your own (Harbor / Distribution)
docker run -d --restart=always -p 5000:5000 --name registry registry:2
docker tag me/app:1.4.0 localhost:5000/me/app:1.4.0
docker push localhost:5000/me/app:1.4.0
# 7) Sign images so deployers can verify provenance (sigstore / cosign)
cosign sign --key cosign.key ghcr.io/me/app:1.4.0
cosign verify --key cosign.pub ghcr.io/me/app:1.4.0
# 8) Best practices
# • Tag by version + immutable SHA (never deploy by :latest)
# • Use private registries for anything proprietary
# • Enable image scanning (Trivy, Snyk, ECR Image Scan)
# • Sign images + verify at deploy time
# • Retention policies — old tags pile up fast
Why it matters
:latest is convenient and dangerous. Pin a SHA or version in production manifests — otherwise a registry race or accidental push silently changes what runs.
Tip: Tweak the snippet with Try it Yourself », then sit the quiz at the bottom of the page.
Discussion
Loading…