Docker Cheatsheet 15 — Registries and Image Distribution

[registry/]namespace/repo[:tag][@digest]

docker.io/library/nginx:latest
ghcr.io/myorg/myapp:v1.0
123456.dkr.ecr.us-east-1.amazonaws.com/myapp:v1
nginx@sha256:abc123...

docker build -t myapp:v1 .
docker tag myapp:v1 ghcr.io/me/myapp:v1
docker push ghcr.io/me/myapp:v1

docker tag myapp ghcr.io/me/myapp:v1
docker tag myapp ghcr.io/me/myapp:latest
docker push --all-tags ghcr.io/me/myapp

# Docker Hub
docker login -u USER

# GHCR
echo $GITHUB_TOKEN | docker login ghcr.io -u USER --password-stdin

# AWS ECR
aws ecr get-login-password --region us-east-1 \
  | docker login --username AWS --password-stdin 123456.dkr.ecr.us-east-1.amazonaws.com

# GCP Artifact Registry
gcloud auth configure-docker us-central1-docker.pkg.dev

docker run -d \
  -p 5000:5000 \
  -v $(pwd)/registry:/var/lib/registry \
  --restart=unless-stopped \
  --name registry \
  registry:2

docker tag myapp localhost:5000/myapp:v1
docker push localhost:5000/myapp:v1

docker run -d \
  -p 5000:5000 \
  -v $(pwd)/certs:/certs \
  -v $(pwd)/auth:/auth \
  -e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/cert.pem \
  -e REGISTRY_HTTP_TLS_KEY=/certs/key.pem \
  -e REGISTRY_AUTH=htpasswd \
  -e REGISTRY_AUTH_HTPASSWD_REALM="Registry" \
  -e REGISTRY_AUTH_HTPASSWD_PATH=/auth/htpasswd \
  registry:2

docker run --rm --entrypoint htpasswd httpd:2 -Bbn USER PASS > auth/htpasswd

# Quick start
git clone https://github.com/goharbor/harbor
cd harbor
./install.sh

// /etc/docker/daemon.json
{ "registry-mirrors": ["https://mirror.example.com"] }

docker run -d --restart=always \
  -e REGISTRY_PROXY_REMOTEURL=https://registry-1.docker.io \
  -p 5000:5000 \
  registry:2

docker save -o myapp.tar myapp:v1
scp myapp.tar server:
ssh server "docker load < myapp.tar"

dev → staging → prod

docker pull ghcr.io/me/myapp:sha-abc123
docker tag ghcr.io/me/myapp:sha-abc123 ghcr.io/me/myapp:staging
docker push ghcr.io/me/myapp:staging
# After QA:
docker tag ghcr.io/me/myapp:sha-abc123 ghcr.io/me/myapp:prod
docker push ghcr.io/me/myapp:prod

# Docker registry
docker exec registry registry garbage-collect /etc/docker/registry/config.yml

# Harbor: UI / API

- uses: docker/login-action@v3
  with:
    registry: ghcr.io
    username: ${{ github.actor }}
    password: ${{ secrets.GITHUB_TOKEN }}

- uses: docker/build-push-action@v6
  with:
    push: true
    tags: |
      ghcr.io/${{ github.repository }}:latest
      ghcr.io/${{ github.repository }}:${{ github.sha }}

cosign generate-key-pair
cosign sign --key cosign.key myreg/myapp:v1
cosign verify --key cosign.pub myreg/myapp:v1

cosign sign myreg/myapp:v1