Working with Docker Registry

1. Logging into Registry

Command	Description	Example
docker login	Logs into a Docker registry	`docker login registry.example.com`
docker login -u <username> -p <password>	Logs into a registry with username and password	`docker login -u myuser -p mypass`
docker login -u <username> -p <token>	Logs into a registry using an access token	`docker login -u myuser -p mytoken`

Note: Credentials are stored in ~/.docker/config.json by default.

2. Logging out from Registry

Command	Description	Notes
docker logout	Remove stored credentials for a registry	Removes stored credentials for the specified registry or default registry

Example: Logging out from a specific registry

docker logout registry.example.com

Example: Logging out from the default registry

docker logout

3. Tagging for Different Registries

Tag Format	Description	Examples
registry.example.com:5000/namespace/image:tag	Full registry URL with namespace and tag	`registry.example.com:5000/myapp/web:latest`
namespace/image:tag	Registry with default Docker Hub namespace	`myorg/myapp:prod`
image:tag	Default Docker Hub image with tag	`nginx:alpine`

Example: Pushing to a Private Registry

docker build -t registry.example.com:5000/myapp/web:latest .
docker push registry.example.com:5000/myapp/web:latest

Example: Using Tagging for Multi-Architecture Images

docker buildx build --platform linux/amd64,linux/arm64 \
  -t myregistry.com/app:latest \
  --push .

Note: When tagging for private registries, ensure the registry URL is accessible and credentials are configured via docker login.

4. Pushing Images

Command	Description	Example
docker push	Pushes an image to a registry	`docker push my-image:latest`

Example: Pushing to Docker Hub

docker push username/my-app:1.0

Note: Ensure you are logged into the registry using docker login before pushing.

Warning: Pushing large images may take time and consume bandwidth.

5. Pulling from Private Registry

Command	Description	Example
docker pull	Fetches an image from a registry	`docker pull my-registry.com/my-app:latest`
docker pull --platform	Specifies the platform for the image	`docker pull --platform linux/amd64 my-registry.com/my-app:latest`

Example: Pulling an Image from a Private Registry

docker pull my-private-registry.com/myapp:v1.2.3

Note: Ensure you are authenticated to the private registry before pulling images. Use docker login if needed.

Warning: If the registry requires authentication, make sure credentials are correctly configured in ~/.docker/config.json.

6. Using Docker Hub Repositories

Command	Description	Example
docker login	Log in to Docker Hub	`docker login`
docker push	Push an image to Docker Hub	`docker push username/image-name:tag`
docker pull	Download an image from Docker Hub	`docker pull username/image-name:tag`

Example: Pushing an Image to Docker Hub

docker build -t myapp:latest .
docker tag myapp:latest username/myapp:latest
docker push username/myapp:latest

Example: Pulling an Image from Docker Hub

docker pull node:18-alpine

Note: Ensure your Docker Hub credentials are configured via docker login before pushing images.

Key Concepts

Docker Hub is the default public registry for Docker images.
Images must be tagged with a valid namespace (e.g., username/image-name) to push to Docker Hub.
Public repositories are accessible without authentication, while private ones require login.

7. Running Local Registry

Example: Start a local registry with Docker

docker run -d \
  --name local-registry \
  --restart=always \
  -p 5000:5000 \
  registry:2

Option	Values	Description
--name	`local-registry`	Name of the registry container
-p	`5000:5000`	Map host port 5000 to container port 5000
--restart	`always`	Restart policy to ensure registry stays running

Note: The registry image is pulled from Docker Hub by default. Ensure the local registry is accessible over HTTP if not using TLS.

Example: Push image to local registry

docker tag myapp:latest localhost:5000/myapp:latest
docker push localhost:5000/myapp:latest

Warning: For production use, configure TLS for the local registry to avoid security issues.

8. Configuring Insecure Registries

When using Docker with self-signed or private registries, you may encounter issues due to SSL/TLS certificate validation. Insecure registries allow Docker to communicate with registries that do not have valid certificates.

Configuration Option	Description	Example
insecure-registries	List of registry hosts that are allowed to be accessed without TLS verification	`192.168.1.100:5000`

Example: Docker Daemon Configuration

{
  "insecure-registries": [
    "192.168.1.100:5000",
    "registry.example.com:443"
  ]
}

Note: Adding registries to insecure-registries bypasses TLS verification, which can introduce security risks. Only use this for trusted internal registries.

Warning: Insecure registries are not recommended for production environments due to the risk of man-in-the-middle attacks.

9. Authenticating with Token

Method	Description	Example
docker login	Authenticate to a registry using username and password	`docker login registry.example.com`
docker login --username	Authenticate with a specific username and password	`docker login --username user@example.com registry.example.com`
docker login --password-stdin	Authenticate using a password provided via stdin (more secure)	`echo "mypassword" \| docker login --username user@example.com --password-stdin registry.example.com`

Example: Using Token Authentication

docker login --username 0123456789abcdef --password-stdin registry.example.com << "token"

Note: Token-based authentication is preferred for CI/CD pipelines and automated systems.

Warning: Avoid hardcoding passwords in scripts. Use environment variables or secure credential stores.

10. Managing Registry Credentials

Command	Description	Flags
docker login	Authenticate to a Docker registry	`-u, --username`, `-p, --password`
docker logout	Log out from a Docker registry	`-u, --username`

Example: Logging into a registry

docker login registry.example.com

Example: Logging in with credentials

docker login -u myuser -p mypassword registry.example.com

Note: Credentials are stored in ~/.docker/config.json by default.

Warning: Avoid hardcoding credentials in scripts or command-line arguments.

11. Implementing Registry Webhooks

Registry webhooks allow you to trigger automated actions when events occur in a Docker registry, such as image pushes or deletions. These are useful for CI/CD pipelines, image scanning, and automated deployment workflows.

Event Type	Description	Trigger Condition	Example Use Case
push	Image is pushed to the registry	New image tag is created or updated	Trigger a CI pipeline to build and test the new image
delete	Image or tag is deleted from the registry	Specific image or tag is removed	Update deployment configurations to remove outdated images
pull	Image is pulled from the registry	Image is accessed by a client	Log access or trigger analytics

Example: Setting up a Webhook Endpoint

const express = require("express");
const app = express();

app.use(express.json());

app.post("/webhook", (req, res) => {
  const event = req.body.events[0];
  console.log("Received event:", event.action, event.target.tag);
  // Perform actions based on the event type
  res.status(200).send("OK");
});

app.listen(3000, () => {
  console.log("Webhook server listening on port 3000");
});

Note: Webhooks require a publicly accessible endpoint. For local testing, tools like ngrok can be used to expose a local server.

Warning: Ensure that webhook endpoints are secured to prevent unauthorized access or abuse. Consider using authentication tokens or signature verification.

12. Configuring Registry Storage Backends

Backend	Description	Configuration Example	Notes
filesystem	Stores images on the local filesystem	`{<br> "storage": {<br> "filesystem": {<br> "rootdirectory": "/var/lib/registry"<br> }<br> }<br>}`	Simple and suitable for development or small setups
s3	Stores images in Amazon S3-compatible storage	`{<br> "storage": {<br> "s3": {<br> "bucket": "my-registry-bucket",<br> "region": "us-east-1",<br> "accesskeyid": "AKIAIOSFODNN7EXAMPLE",<br> "secretaccesskey": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"<br> }<br> }<br>}`	Highly scalable and suitable for production environments
gcs	Stores images in Google Cloud Storage (GCS)	`{<br> "storage": {<br> "gcs": {<br> "bucket": "my-registry-bucket",<br> "keyfile": "/path/to/service-account-key.json"<br> }<br> }<br>}`	Requires GCP service account with appropriate permissions
azure	Stores images in Azure Blob Storage	`{<br> "storage": {<br> "azure": {<br> "accountname": "myregistryaccount",<br> "container": "registry-container",<br> "accesskey": "my-access-key"<br> }<br> }<br>}`	Supports both managed and self-hosted Azure environments
oss	Stores images in Alibaba Cloud OSS	`{<br> "storage": {<br> "oss": {<br> "bucket": "my-registry-bucket",<br> "endpoint": "oss-cn-hangzhou.aliyuncs.com",<br> "accesskeyid": "LTAI4Ft234567890",<br> "accesskeysecret": "abc123def456ghi789"<br> }<br> }<br>}`	Requires valid Alibaba Cloud credentials and bucket

Example: Configuring S3 Storage Backend

{<br>  "storage": {<br>    "s3": {<br>      "bucket": "my-docker-registry",<br>      "region": "us-west-2",<br>      "accesskeyid": "AKIAIOSFODNN7EXAMPLE",<br>      "secretaccesskey": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY",<br>      "rootdirectory": "/registry"<br>    }<br>  },<br>  "http": {<br>    "addr": ":5000"<br>  }<br>}

Note: Ensure that the IAM user or role used for S3 access has sufficient permissions to read and write to the specified bucket.