Image Management & Registries

Building images locally is just the beginning. To share, deploy, and version your images, you need to understand registries, tagging strategies, and image lifecycle management. This lesson covers Docker Hub, private registries, tagging, pushing/pulling, image inspection, and housekeeping.

---

What Is a Registry?

A container registry is a storage and distribution service for container images. It works like a package repository (npm, PyPI) but for Docker images.

+------------------+       push        +------------------+
|   Developer      | ----------------> |   Registry       |
|   (docker push)  |                   |   (Docker Hub,   |
+------------------+       pull        |    ECR, GCR,     |
|   CI/CD Server   | <---------------- |    GHCR, etc.)   |
|   (docker pull)  |                   +------------------+
+------------------+

Popular Registries

Registry	Provider	URL
Docker Hub	Docker	hub.docker.com
GitHub Container Registry (GHCR)	GitHub	ghcr.io
Amazon ECR	AWS	*.dkr.ecr.region.amazonaws.com
Google Artifact Registry	Google	*.pkg.dev
Azure Container Registry	Microsoft	*.azurecr.io
GitLab Container Registry	GitLab	registry.gitlab.com

---

Docker Hub

Docker Hub is the default registry. When you run docker pull nginx, Docker pulls from Docker Hub.

Logging In

# Interactive login
docker login

# Login to a specific registry
docker login ghcr.io
docker login 123456789012.dkr.ecr.eu-west-1.amazonaws.com

Image Naming Convention

registry/namespace/repository:tag

# Docker Hub (registry is implicit)
nginx:1.25-alpine            # Official image
myuser/my-app:1.0            # User image

# GitHub Container Registry
ghcr.io/myorg/my-app:latest

# Amazon ECR
123456789012.dkr.ecr.eu-west-1.amazonaws.com/my-app:v2.1

---

Tagging Strategies

Tags are labels attached to image digests. A good tagging strategy is crucial for reliable deployments.

Semantic Versioning

docker build -t my-app:1.0.0 .
docker tag my-app:1.0.0 my-app:1.0
docker tag my-app:1.0.0 my-app:1
docker tag my-app:1.0.0 my-app:latest

This creates a hierarchy:

• 1.0.0 — exact version (immutable)
• 1.0 — latest patch within 1.0.x
• 1 — latest minor within 1.x.x
• latest — most recent release

Git SHA Tagging

# Tag with the short git commit SHA
docker build -t my-app:$(git rev-parse --short HEAD) .

Date-Based Tagging

docker build -t my-app:$(date +%Y%m%d-%H%M%S) .
# e.g. my-app:20260305-143022

Recommended Strategy

Tag	Purpose	Mutable?
v1.2.3	Exact release version	No
abc1234	Git commit SHA	No
latest	Most recent build	Yes
main	Latest build from main branch	Yes

Best practice: Use immutable tags (semver + SHA) for production. Use latest only for development convenience.

---

Pushing and Pulling Images

Pushing to Docker Hub

# Tag the image with your Docker Hub username
docker tag my-app:1.0.0 myuser/my-app:1.0.0

# Push to Docker Hub
docker push myuser/my-app:1.0.0

# Push all tags for a repository
docker push myuser/my-app --all-tags

Pushing to GHCR

# Login to GHCR
echo \$GITHUB_TOKEN | docker login ghcr.io -u USERNAME --password-stdin

# Tag and push
docker tag my-app:1.0.0 ghcr.io/myorg/my-app:1.0.0
docker push ghcr.io/myorg/my-app:1.0.0

Pulling Images

# Pull latest
docker pull myuser/my-app