Techie BabajiLearn to Code. Build Real Skills.
DevOps · Containers

Container Registries

A container registry stores your images so servers, clusters and pipelines can pull exactly the version they need.

Intermediate 5 min Lesson 17 of 30
Before you start:Docker Images
0/30 in DevOps
On this page · 5 min · Intermediate

On this page

  1. Learning objectives
  2. Explanation
  3. Code example
  4. Step by step
  5. Real-world use
  6. Common mistakes
  7. Best practices
  8. Remember this
  9. Practice exercise
  10. Mini quiz
  11. Related topics
  12. My notes
Reading time
5 min
Difficulty
Intermediate
Updated
Oct 29, 2026

Related tutorials

Interview questions

Learning objectives#

  • Push and pull images to a registry
  • Compare popular registries
  • Choose a tagging strategy
  • Scan and clean up images

Explanation#

An image name includes the registry: ghcr.io/asha/shop-api:1.4.0, myacr.azurecr.io/shop-api:3f2a9c1, 123456789012.dkr.ecr.ap-south-1.amazonaws.com/shop-api:1.4.0.

Docker Hub is public by default; GHCR integrates with GitHub; ACR and ECR live next to your Azure or AWS workloads with IAM-based access.

Tag with immutable versions (semver or commit SHA). Avoid deploying latest.

Turn on vulnerability scanning and retention policies so old images do not pile up.

Code example: Push to GitHub Container Registry#

ShellPush to GitHub Container Registry Illustrative
echo $GITHUB_TOKEN | docker login ghcr.io -u asha --password-stdin


docker tag shop-api:1.0.0 ghcr.io/asha/shop-api:1.0.0
docker tag shop-api:1.0.0 ghcr.io/asha/shop-api:3f2a9c1
docker push ghcr.io/asha/shop-api:1.0.0
docker push ghcr.io/asha/shop-api:3f2a9c1


docker pull ghcr.io/asha/shop-api:1.0.0     # on any server
Expected output
1.0.0: digest: sha256:4f9c…e21 size: 1784
3f2a9c1: digest: sha256:4f9c…e21 size: 1784

This example is illustrative. Copy or download it and run it in your own environment; the expected output is shown above.

Step-by-step explanation#

  1. A token logs in without typing a password.
  2. One image gets two tags: a version and the commit SHA.
  3. Both tags point to the same digest.
  4. Any authorised machine can pull the exact version.

Real-world use case#

CI pushes every main build to a registry; Kubernetes or ECS pulls the tag chosen for each environment.

Common mistakes#

Public images with internal code

Check visibility; keep company images private.

Mutable tags in production

If 1.0.0 can be overwritten, you lose traceability. Enable immutable tags where possible.

Best practices#

  • Private registries for company code
  • Immutable version tags
  • Scan on push
  • Retention policies for old images

Remember this#

registry/repository:tag.

Version or SHA tags, not latest.

Scan and clean up.

Practice exercise#

Your task: Log in to Azure Container Registry named acrshop with the Azure CLI.

Show solution
Shell Illustrative
az acr login --name acrshop

Mini quiz#

Container Registries quizMultiple choice Question 1 of 1

In ghcr.io/asha/shop-api:1.0.0, what is ghcr.io?

Score so far: 0/0

Want more? Practise all DevOps MCQs · DevOps interview questions

My notes#

Saved in this browser.

Progress is saved in this browser. Sign in to sync.