What is a Docker registry and how do push and pull work?
Learn what a Docker registry is, how repositories and tags organize images, and how docker push and pull transfer only the layers a host is missing.
Expected Interview Answer
A Docker registry is a storage and distribution system for container images; push uploads a tagged local image to the registry, and pull downloads an image from the registry to a local host.
A registry (like Docker Hub, GitHub Container Registry, or a private Harbor instance) organizes images into repositories, each holding multiple tags. To push, you tag the image with the registry and repository name, authenticate with docker login, and run docker push, which uploads only the layers the registry does not already have. Pull works in reverse: docker pull fetches the image manifest and any missing layers by their content-addressed digests, so shared layers are downloaded once and cached.
- Central place to store and share images
- Layer deduplication makes push/pull efficient
- Tags enable versioning and rollbacks
- Supports public and private access control
- Enables CI/CD to distribute images across environments
AI Mentor Explanation
A registry is like a national board's central library of match footage. Pushing is a broadcaster uploading a newly filmed match under a dated label; pulling is a coach downloading that exact match to study. Because clips already held are not re-sent, only the fresh footage travels over the wire.
Step-by-Step Explanation
Step 1
Understand repositories and tags
A registry holds repositories; each repository holds tags like app:1.0 that point to specific image digests.
Step 2
Authenticate
Run docker login registry to store credentials for pushing to private repositories.
Step 3
Tag the image
Use docker tag localimage registry/user/app:tag so Docker knows the destination repository.
Step 4
Push
docker push uploads the manifest and only the layers the registry does not already contain.
Step 5
Pull
docker pull downloads the manifest and any missing layers by digest, caching shared layers locally.
What Interviewer Expects
- Defines a registry as image storage and distribution
- Knows repositories, tags, and digests
- Explains tagging before push
- Understands layer deduplication on push/pull
- Mentions docker login for private registries
Common Mistakes
- Confusing a registry with a single repository
- Forgetting to tag the image with the registry name before push
- Assuming every push uploads the entire image every time
- Not authenticating before pushing to a private registry
- Thinking latest is a special auto-updating tag
Best Answer (HR Friendly)
“A Docker registry is an online storage service for container images, like an app store for containers. Push means uploading your image to the registry so others can use it, and pull means downloading an image from the registry onto a machine to run it.”
Code Example
# Log in to the registry (Docker Hub in this example)
docker login
# Tag the local image for the target repository
docker tag myapp:latest myuser/myapp:1.0
# Push uploads only layers the registry does not already have
docker push myuser/myapp:1.0
# On another host, pull downloads the manifest + missing layers
docker pull myuser/myapp:1.0
# Push to a private/self-hosted registry
docker tag myapp:latest registry.example.com/team/myapp:1.0
docker push registry.example.com/team/myapp:1.0Follow-up Questions
- What is the difference between a registry, a repository, and a tag?
- How does Docker deduplicate layers during push and pull?
- What is an image digest and how does it differ from a tag?
- How would you run a private registry with the registry image?
- What does the 'latest' tag actually mean?
MCQ Practice
1. What does docker push do?
docker push uploads a locally tagged image (and its missing layers) to the specified registry repository.
2. Why is pushing an updated image often fast?
Layers are content-addressed, so Docker uploads only the layers the registry does not already store.
3. What must you usually do before pushing to a private registry?
docker login authenticates you so the registry authorizes the push to a private repository.
Flash Cards
What is a Docker registry? — A storage and distribution system for container images, organized into repositories and tags (e.g. Docker Hub, GHCR).
What does push do? — Uploads a tagged local image to a registry, sending only the layers the registry does not already have.
What does pull do? — Downloads an image's manifest and any missing layers from a registry, caching shared layers locally.
What is a tag? — A human-readable label like app:1.0 that points to a specific image digest within a repository.