Docker Registry & Hub
Difficulty: easy
Overview
A Docker registry is a storage and distribution service for Docker images.
Docker Hub:
- Default public registry at
hub.docker.com(registry:docker.io). - Official images: Maintained by Docker/upstream (e.g.,
nginx,postgres,node) — no username prefix. - User images:
username/image:tagformat. - Rate limits: 100 pulls/6h unauthenticated; 200 pulls/6h free authenticated; unlimited for paid plans.
Image Reference Format:
[registry/][namespace/]repository[:tag][@digest]
- Omitting registry → defaults to
docker.io - Omitting tag → defaults to
latest - Digest:
image@sha256:abc...— immutable, cryptographic reference
Registry Operations:
| Command | Description |
|---|---|
docker login | Authenticate with Docker Hub |
docker login registry.example.com | Authenticate with private registry |
docker pull image:tag | Download image |
docker push image:tag | Upload image (must be tagged with your namespace) |
docker tag src dst | Alias/retag an image |
docker search term | Search Docker Hub |
Private Registry:
- Self-hosted:
docker run -d -p 5000:5000 registry:2(Docker's open-source registry). - Cloud options: AWS ECR, GCP Artifact Registry, Azure ACR, GitHub Container Registry (GHCR).
- Always configure TLS and authentication for production.
Docker Content Trust (DCT):
- Image signing via Notary. Set
DOCKER_CONTENT_TRUST=1to enforce signed-image-only pulls. - Tags are mutable; digests are immutable — use digests in production for reproducibility.
Practice Linked Questions
Q1. What is Docker Hub and what is its default role in the Docker workflow?
Select one answer before revealing.
Q2. Before you can push an image to your Docker Hub account, what must the image tag include?
Select one answer before revealing.
Q3. What does the `docker tag` command do?
Select one answer before revealing.
Q4. What is the difference between a Docker registry and a Docker repository?
Select one answer before revealing.
Q5. How do you authenticate to Docker Hub before pushing images?
Select one answer before revealing.
Q6. What is the purpose of image digests (e.g., `nginx@sha256:abc123...`)?
Select one answer before revealing.
Q7. What is Docker Content Trust (DCT) and how is it enabled?
Select one answer before revealing.
Q8. How do you set up a simple private Docker registry on a local server?
Select one answer before revealing.
Q9. Docker Hub imposes rate limits on image pulls. What are the limits for unauthenticated users?
Select one answer before revealing.
Q10. What does `docker search nginx` do?
Select one answer before revealing.
Q11. Which of the following are valid Docker image reference formats? (Select all that apply — more than one answer may be correct.)
Select one answer before revealing.
Q12. An image built locally as `myapp:latest` needs to be pushed to Docker Hub under the user `devteam`. What is the correct sequence of commands?
Select one answer before revealing.
Q13. How does Docker handle image layer deduplication when multiple images share the same base?
Select one answer before revealing.