Docker registries: Hub, private registry, and image distribution

Docker uses a hierarchical storage model for images:

• Registry — a service that stores and distributes images (default: Docker Hub).
• Repository — a set of related images, usually different versions of one application.
• Tag — an alphanumeric identifier within a repository (e.g., 14.04, stable).

So docker pull amouat/revealjs:latest pulls the latest tag from repository amouat/revealjs on Docker Hub.

Public registry services:

• open_in_new Docker Hub
• open_in_new Quay.io

Authentication

Docker stores credentials in ~/.docker/config.json (formerly ~/.dockercfg).

docker login
docker logout

docker login registers or signs in to a registry (defaults to Docker Hub). docker logout signs out.

Pull and push

docker pull <repository>[:<tag>]
docker push <repository>[:<tag>]

If no tag is specified, latest is assumed. Use -a with docker pull to pull all tags from a repository.

Example:

docker push amouat/cowsay

Without an explicit tag, the image is pushed as latest. To set a custom tag: docker build -t amouat/cowsay:stable.

After a successful push, anyone can pull with docker pull amouat/cowsay.

Search

docker search <pattern>

Lists up to 25 public Docker Hub repositories matching the pattern. Filters for stars and automated builds are available, but searching on the Hub website is often easier.

Automated builds

Docker Hub can rebuild and store an image whenever source code changes on GitHub or Bitbucket. Configure automated builds through the Docker Hub web interface after linking a source repository.

Private registry with registry:2

Run a local registry:

docker run -d -p 5000:5000 registry:2

Tag and push an image:

docker tag amouat/identidock:0.1 localhost:5000/identidock:0.1
docker push localhost:5000/identidock:0.1

TLS

Remote registry nodes require an SSL certificate. See the Docker documentation for certificate setup.

Storage backend

By default, registry:2 stores data on the local filesystem — fine for development. For production, mount a volume and configure persistent storage in config.yml:

storage:
    filesystem:
        rootdirectory: /var/lib/registry

For cloud storage, use the Amazon S3 or Microsoft Azure drivers.

Authentication

Configure registry authentication separately — see the Docker documentation for htpasswd and token-based auth.

Commercial options

For a web UI, RBAC, and enterprise features:

• open_in_new Docker Trusted Registry — a locally installed, Hub-like registry with metrics, role-based access control, and audit logs. It is Docker Inc.’s only closed-source product.
• open_in_new CoreOS Quay Enterprise Registry

Both offer team management, fine-grained access control, and an admin console.