Docker Registry

Docker Registry

A registry distributes container images. Docker Hub is a hosted registry, while organizations may use cloud registries or self-hosted Registry deployments for network control, retention, policy, and internal artifacts.

Core ideas

• A repository groups image manifests under one name; tags point to manifests.
• Authentication controls push and private pull, while authorization should restrict repositories and actions.
• A digest is content-addressed and immutable, so it prevents tag movement from changing a deployment.
• A pull-through cache proxies an upstream registry and stores frequently used content locally.

How it works

Name the image with a registry host, repository, and release tag; authenticate with a short-lived token; push; then verify and record the digest. Configure retention carefully so active digests remain available. Production platforms should scan and, where appropriate, verify signatures or attestations before deployment.

Command or configuration example

REGISTRY=registry.example.com
docker login "$REGISTRY" --username ci --password-stdin
docker tag my-api:1.4.0 "$REGISTRY/platform/my-api:1.4.0"
docker push "$REGISTRY/platform/my-api:1.4.0"
docker inspect --format='{{index .RepoDigests 0}}' \
  "$REGISTRY/platform/my-api:1.4.0"

Run examples first in a disposable environment. Replace image names, versions, credentials, ports, paths, and resource values with reviewed settings appropriate to your system.

Production guidance

• Use credential helpers or CI secret binding instead of storing plaintext credentials.
• Apply immutable release tags and deploy verified digests.
• Protect the registry with TLS, access logs, backups, vulnerability policy, and tested retention rules.

The chapter quiz follows this lesson and checks the concepts as well as the operational tradeoffs.