Container Registry Explained
What a Container Registry Stores and Why It Matters
A container registry is a server that stores container images and lets people and tools download them. When a machine runs a container, it usually pulls the image from a registry first. Docker Hub is one well-known public registry, and many cloud providers and software vendors run their own.
Registries organize images into repositories. A repository holds related versions of one image, such as each release of an application. Each version is labelled with a tag, such as a version name or the word latest. Tags are convenient, but a tag can be moved to point at a different image, so it does not guarantee that you get the same code twice.
For a fixed reference, each image also has a digest. A digest is a cryptographic hash of the image content. If the content changes, the digest changes too, so referring to an image by digest ensures the same image is pulled every time.
Public and Private Registries Compared
A public registry lets anyone pull images, and often anyone can publish them. Public registries suit open-source software and common base images, such as standard operating system images and language runtimes. Because anyone can upload, check the source of an image before you rely on it.
A private registry restricts access to specific users, teams or machines. Companies use private registries for internal applications that must not be public. A private registry can be hosted by a cloud provider or run on the company's own servers using open-source registry software.
Registries transfer data efficiently. Because images share layers, a machine downloads only the layers it does not already have. Copying an image into a private registry works the same way, so shared layers are stored only once.
A Hosting Team Deploying From a Private Registry
A hosting team builds its web application image on a build server and pushes it to a private registry under a version tag. Production servers pull that image and start containers from it. If a new release causes problems, the team can return to the previous version, because older images remain in the registry until someone deletes them.
Frequently asked questions
Is Docker Hub the Only Container Registry?
No. Docker Hub is one widely used registry. Others are run by cloud providers, software vendors, open-source projects and companies for their own use. Tools such as Docker can use any registry that supports the same open distribution standard, so an image pushed to one can usually be pulled from another.
What Is the Difference Between a Tag and a Digest?
A tag is a readable label, such as a version name, and it can be reassigned to a different image. A digest is a hash of the image content, so the same digest always refers to the same content. Use digests when you need certainty about which image runs, and tags when you want readable names.
Is It Safe to Store Images in a Public Registry?
Only if the image contains nothing sensitive. Anyone who can pull a public image can read its layers, so passwords, private keys and proprietary code should never be built into an image. Keep such secrets in a private registry, or supply them when the container starts.