Container registry

What is a container registry?

A container registry stores and distributes container images. The application is only started from the image in a runtime environment. Docker distinguishes a registry from a repository, a collection of related images within it. Registries can be public or access-restricted.

A tag is a readable reference to an image version. In the fictional example, portal:stable initially points to IMG-A and, after a new approval, to IMG-B. These two image labels are our own example names, not actual digest values. The unchanged tag does not establish that the same content is being downloaded.

Retrieve an approved version traceably

Docker documents using an immutable digest to retrieve a specific image. Record this identifier and the associated check for the approved version. A digest alone establishes neither a trustworthy origin nor approval by your team. Security updates must be checked deliberately and adopted through a newly selected version.

Define who may upload, retrieve and remove images, and which versions are retained. A deployment must still be able to access its required image. Whether new images are deployed automatically is determined by the connected deployment pipeline. Storing them in the registry does not by itself describe that workflow.

Sources

• Docker — What is a registry?

• Docker — Pull an image by digest