Home/Learn/Docker/Docker Registry & Image Management

Docker Registry & Image Management

Intermediate

CI/CD

A registry stores and distributes Docker images. Understanding image tagging strategies, pushing to Docker Hub or cloud registries (ECR, GCR, ACR), and image scanning is essential for CI/CD pipelines.

Overview

Docker Hub is the default public registry. In production, teams use private registries: AWS ECR, Google GCR, Azure ACR, or self-hosted Harbor. Image tags are mutable pointers to image digests (SHA256). The tag latest is just a convention — it is not automatically updated. Production pipelines tag images with the Git commit SHA for traceability. Image scanning (Trivy, Snyk, Docker Scout) checks images for known CVEs in OS packages and application dependencies before deployment.

Tagging & Pushing Images

docker build -t gives an image a name:tag. docker push uploads to a registry. Image names follow the format: [registry/]username/repo:tag.

bash — tagging and pushing to registries

# Build and tag

docker build -t myapp:latest .

docker build -t myapp:v1.2.3 .

docker build -t myapp:$(git rev-parse --short HEAD) .   # Git SHA tag



# Tag an existing image with a new name/registry

docker tag myapp:latest docker.io/myusername/myapp:latest

docker tag myapp:latest 123456789.dkr.ecr.us-east-1.amazonaws.com/myapp:v1.2.3



# Push to Docker Hub

docker login                                              # auth

docker push myusername/myapp:latest



# Push to AWS ECR

aws ecr get-login-password --region us-east-1 | \

  docker login --username AWS --password-stdin \

  123456789.dkr.ecr.us-east-1.amazonaws.com



docker push 123456789.dkr.ecr.us-east-1.amazonaws.com/myapp:v1.2.3



# Pull from private registry

docker pull 123456789.dkr.ecr.us-east-1.amazonaws.com/myapp:v1.2.3

CI/CD Pipeline Integration

A typical GitHub Actions pipeline builds, tests, scans, and pushes the image on every merge to main.

GitHub Actions — build, push, scan pipeline

# .github/workflows/docker.yml

name: Build & Push Docker Image



on:

  push:

    branches: [main]



jobs:

  build:

    runs-on: ubuntu-latest

    steps:

      - uses: actions/checkout@v4



      - name: Set up Docker Buildx

        uses: docker/setup-buildx-action@v3



      - name: Login to ECR

        uses: aws-actions/amazon-ecr-login@v2



      - name: Build & Push

        uses: docker/build-push-action@v5

        with:

          context: .

          push: true

          tags: |

            ${{ env.ECR_REGISTRY }}/myapp:latest

            ${{ env.ECR_REGISTRY }}/myapp:${{ github.sha }}

          cache-from: type=gha      # GitHub Actions cache for layers

          cache-to: type=gha,mode=max



      - name: Scan with Trivy

        uses: aquasecurity/trivy-action@master

        with:

          image-ref: ${{ env.ECR_REGISTRY }}/myapp:${{ github.sha }}

          severity: CRITICAL,HIGH

          exit-code: '1'            # fail pipeline if critical CVEs found

Image Digest vs Tag

Tags are mutable — latest today may be a different image than latest tomorrow. For production deployments, always reference images by immutable SHA256 digest.

bash — digest, tagging strategies, multi-arch

# Get image digest

docker inspect --format='{{index .RepoDigests 0}}' nginx:latest

# nginx@sha256:a4723cc84e6b28ca... â† immutable, always the same image



# Pull by digest (guaranteed reproducible)

docker pull nginx@sha256:a4723cc84e6b28ca9e3dd45e75e5a5c5b69513c0



# Tag strategies:

# latest       â†’ convenient, not reproducible

# v1.2.3       â†’ semantic versioning, stable

# git-abc1234  â†’ traceability to commit (production best practice)

# main-20240128 â†’ branch + date



# Multi-arch builds (Apple Silicon + Linux servers)

docker buildx build \

  --platform linux/amd64,linux/arm64 \

  --push \

  -t myregistry/myapp:v1.2.3 .

Key Points to Remember

1Tags are mutable pointers; digests (SHA256) are immutable — use digests for reproducible prod deployments.
2latest is just a tag convention, not a special feature — it is not automatically updated.
3Use Git SHA tags in CI/CD for full traceability from running container back to source commit.
4Scan images for CVEs (Trivy, Docker Scout) in CI before pushing to production registries.
5Multi-arch builds (--platform linux/amd64,linux/arm64) support both Intel servers and Apple Silicon dev machines.
6ECR, GCR, ACR are cloud-native private registries — prefer over Docker Hub for production.

Interview Questions

Why is using the latest tag in production problematic?

What is image scanning and when do you do it?

Ask Aria about Docker Registry & Image Management

Your personal AI tutor — ask anything about this concept

Revision Status

Personal Notes

Discussion

Loading discussion…

Docker Compose — Multi-Container Apps

Docker Security Best Practices