Skip to main content
Where do Docker images actually live? Behind every docker pull is a Docker registry — a central service that stores container images and serves them to clients. In this article you’ll learn how registries work, which public registries you’ll commonly use, and how to run a private registry for development or production. If containers are the rain, registries are the clouds that store and distribute the images.
The image shows the heading "What Is a Registry?" above a large, stylized blue cloud icon. A small "Copyright KodeCloud" notice appears in the bottom corner.

​
What is a registry?

A Docker registry is a service that stores and distributes container images. When you run a container with a shorthand name like:
Docker resolves nginx using Docker’s naming conventions. The name nginx is shorthand for library/nginx in Docker Hub’s default namespace. Since no registry host was provided, Docker assumes the default registry host docker.io. The fully qualified image reference becomes:
Image references generally follow this pattern:
  • registry — hostname of the registry (defaults to docker.io if omitted)
  • namespace — your username, organization, or library for official images
  • repository — the image name (e.g., nginx)
  • tag — optional tag (defaults to latest)
Where images are stored and pulled from
  • If you do not specify a registry, Docker pulls from Docker Hub (docker.io).
  • When you build and publish an image you docker push it to a registry.
  • When deploying an app or starting a container, you docker pull the image from the registry.
Note: Older resources may still reference gcr.io. Prefer the Artifact Registry endpoints for new setups.

​
Pull rate limits (Docker Hub)

If you pull images frequently (for example in CI pipelines), authenticate using docker login or push your images to registries with more generous limits (GHCR, ECR, ACR, or Google Artifact Registry).

​
Logging in to a registry

To authenticate with the default registry (or a specific registry), use:
This prompts for your username and password and stores credentials locally so future pulls and pushes can succeed.
By default Docker stores credentials/config on disk (e.g., ~/.docker/config.json). Consider using credential helpers or your platform’s secret management for CI systems or shared machines to avoid storing plain credentials.
See the Docker login documentation for more details: https://docs.docker.com/engine/reference/commandline/login/

​
Private registries

You may want private registries to limit access to internal or commercial images. Cloud providers offer managed private registries (ECR, ACR, Artifact Registry), or you can self-host a registry.
A slide titled "Private Registries" showing the AWS, Microsoft Azure, and Google Cloud logos centered near the bottom. A small "Copyright KodeCloud" note appears in the lower-left.
Making a repository private restricts access to authenticated users. Example login and usage for a private registry:
If you do not authenticate first, pulling or running images from a private registry will fail with unauthorized or image-not-found errors. Always authenticate before pushing or pulling private images.

​
Running your own registry (local or on-prem)

The Docker Registry is an application distributed as an official image named registry. By default it exposes the registry API on port 5000. A quick way to run a local registry for development:
Push an image to a local registry:
Pull from the local registry on the same host:
Pull from another host on the same network (replace with Docker host IP or DNS name):
Notes:
  • If your registry uses TLS or requires authentication, configure the registry and client accordingly (certificates, auth configuration, or use a reverse proxy).
  • For production use consider a secure setup with TLS, authentication, storage backend (S3, GCS), and garbage collection.

​
Quick reference

  • Default registry: Docker Hub (docker.io). Example shorthand nginx → docker.io/library/nginx.
  • Fully qualified pattern: <registry>/<namespace>/<repository>:<tag>.
  • Use docker login to authenticate before pulling/pushing private images.
  • Public alternatives to Docker Hub: ghcr.io, AWS ECR, Azure ACR, Google Artifact Registry.
  • Run a local registry with the registry:2 image on port 5000.
That’s it for this lesson. Complete the practice exercises included with the lesson to reinforce pushing, pulling, and running a private registry.

Watch Video

Practice Lab