Docker Hub and Registries

Docker Hub and Container Registries

A container registry stores and distributes Docker images. Docker Hub is the default public registry. Cloud providers offer private registries for production use.

Docker Hub

Docker Hub is the default registry. When you pull nginx, Docker actually pulls from docker.io/library/nginx:latest.

# Pull an image
docker pull nginx:alpine
docker pull node:20

# Pull a specific version
docker pull postgres:16.1-alpine

# Pull with full registry path (equivalent)
docker pull docker.io/library/nginx:latest

Logging In

docker login                          # Docker Hub
docker login myregistry.example.com   # private registry
docker login ghcr.io                  # GitHub Container Registry
docker login registry.gitlab.com      # GitLab Registry

Credentials are stored in ~/.docker/config.json.

Tagging and Pushing

# Build and tag
docker build -t myusername/my-app:1.0.0 .
docker build -t myusername/my-app:latest .

# Tag an existing image
docker tag my-app:local myusername/my-app:1.0.0

# Push to Docker Hub
docker push myusername/my-app:1.0.0
docker push myusername/my-app:latest

Tagging Strategy

# Tag by version AND latest
docker tag my-app myusername/my-app:1.2.3
docker tag my-app myusername/my-app:1.2
docker tag my-app myusername/my-app:latest

docker push myusername/my-app:1.2.3
docker push myusername/my-app:1.2
docker push myusername/my-app:latest

Users pinning 1.2 get patch updates automatically. Pinning 1.2.3 gets no updates.

Cloud Registries

Azure Container Registry (ACR)

# Create registry
az acr create --name myregistry --resource-group my-rg --sku Basic

# Login
az acr login --name myregistry

# Push image
docker tag my-app myregistry.azurecr.io/my-app:1.0
docker push myregistry.azurecr.io/my-app:1.0

Google Artifact Registry

# Configure Docker authentication
gcloud auth configure-docker europe-west2-docker.pkg.dev

# Push image
docker tag my-app europe-west2-docker.pkg.dev/my-project/my-repo/my-app:1.0
docker push europe-west2-docker.pkg.dev/my-project/my-repo/my-app:1.0

Amazon ECR

# Authenticate
aws ecr get-login-password --region eu-west-2 | \
  docker login --username AWS --password-stdin 123456789.dkr.ecr.eu-west-2.amazonaws.com

# Push
docker tag my-app 123456789.dkr.ecr.eu-west-2.amazonaws.com/my-app:1.0
docker push 123456789.dkr.ecr.eu-west-2.amazonaws.com/my-app:1.0

GitHub Container Registry (GHCR)

# Login with a Personal Access Token
echo $CR_PAT | docker login ghcr.io -u USERNAME --password-stdin

# Push
docker tag my-app ghcr.io/myusername/my-app:1.0
docker push ghcr.io/myusername/my-app:1.0

Images pushed to GHCR are associated with your GitHub repository — useful for open-source projects.

GitHub Actions Pipeline

name: Build and Push

on:
  push:
    branches: [main]

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Log in to Docker Hub
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_TOKEN }}

      - name: Build and push
        uses: docker/build-push-action@v5
        with:
          push: true
          tags: |
            myusername/my-app:latest
            myusername/my-app:${{ github.sha }}

Useful Commands

# List local images
docker images

# Remove an image
docker rmi myusername/my-app:1.0

# Remove all unused images
docker image prune -a

# Inspect an image (layers, config)
docker inspect myusername/my-app:1.0

# View image history (layers)
docker history myusername/my-app:1.0

# Search Docker Hub
docker search nginx

.dockerignore

Prevent secrets and unnecessary files from being sent to the build context:

.git
.gitignore
node_modules
dist
.env
.env.*
*.log
README.md
Dockerfile*
.dockerignore