Docker Hub and Image Tags: Push and Share Your Images

A registry stores images, so that other computers can pull them. Docker Hub is the default; others include GitHub Container Registry (ghcr.io), and those from AWS, Google Cloud and Azure.

Push to Docker Hub#

1. Create a free account at hub.docker.com.
2. Log in. Use an access token from your account settings, rather than your password.
3. Tag the image with your username.
4. Push it.

docker login
docker tag my-site:1.0 your-name/my-site:1.0
docker push your-name/my-site:1.0

Anyone can now run docker run your-name/my-site:1.0, unless the repository is private.

GitHub Container Registry#

Log in with a GitHub token that has the write:packages permission, and include the registry in the name:

echo "$GITHUB_TOKEN" | docker login ghcr.io -u your-name --password-stdin
docker tag my-site:1.0 ghcr.io/your-name/my-site:1.0
docker push ghcr.io/your-name/my-site:1.0

Try it with a local registry#

A registry is itself a container, so you can try all of this on one computer:

docker run -d --name registry -p 5000:5000 registry:3 > /dev/null
sleep 2
docker pull -q alpine:3.24 > /dev/null
docker tag alpine:3.24 localhost:5000/team/base:1.0
docker push -q localhost:5000/team/base:1.0 2>&1 | tail -n 1 || true
curl -s http://localhost:5000/v2/_catalog

Unable to find image 'registry:3' locally
3: Pulling from library/registry
Digest: sha256:d4032d4cc323c1731c707931ecada07a53076eac38e3b61ae57533f170f2c6c3
Status: Downloaded newer image for registry:3
localhost:5000/team/base:1.0
{"repositories":["team/base"]}

Remove the local copy and pull it back:

docker rmi -f localhost:5000/team/base:1.0 > /dev/null
docker pull -q localhost:5000/team/base:1.0
docker run --rm localhost:5000/team/base:1.0 echo "Pulled from my registry"
docker rm -f registry > /dev/null

localhost:5000/team/base:1.0
Pulled from my registry

Tagging strategy#

One image can have several tags. A good habit is to use a fixed version, and a moving tag:

docker tag alpine:3.24 app:1.4.2
docker tag alpine:3.24 app:1.4
docker tag alpine:3.24 app:latest
docker images app --format '{{.Tag}} {{.ID}}'

1.4 b92841763c5c
1.4.2 b92841763c5c
latest b92841763c5c

In production, deploy a version or commit tag, so that you know what is running, and can roll back.

Digests#

A tag can be moved. A digest is a hash of the image's content, and it never changes:

docker pull alpine:3.24 | grep Digest
docker inspect --format '{{index .RepoDigests 0}}' alpine:3.24

Digest: sha256:be2656061b536c1883c4034790e21d0a09c5aaaf51968b89368a3c0371ea2c9a
alpine@sha256:be2656061b536c1883c4034790e21d0a09c5aaaf51968b89368a3c0371ea2c9a

Pinning to a digest in a FROM line, as in FROM alpine@sha256:..., gives you exactly the same base every time.

Several CPU types#

Laptops with Apple silicon use ARM processors, and many servers use x86. docker buildx can build one image for both:

docker buildx build --platform linux/amd64,linux/arm64 -t your-name/app:1.0 --push .

Common mistakes#

Practice#

for t in 2.0.1 2.0 2; do docker tag alpine:3.24 tools:$t; done
docker images tools --format '{{.ID}}' | sort -u | wc -l

1

Key takeaway#

Next: Volumes.