What is a container registry, and how does Docker Hub fit in?
Quick Answer
A container registry stores, versions, and distributes container images — you push to it and pull from it, the same way a package registry like npm or PyPI works for language libraries. Docker Hub is the default, most widely used public registry, hosting both official/verified images (like node, postgres, nginx) and user/organization-published images. Private registries — self-hosted, or cloud-provider-managed like ECR/GCR/ACR — hold images an organization doesn't want publicly accessible.
Detailed Answer
What a registry actually does
A registry stores and distributes container images. It's organized by repository (a named collection of related images, usually for one application) and tag (a specific version within that repository). Pushing uploads a locally-built image to the registry. Pulling downloads an image from the registry to a local machine — this also happens automatically whenever you start a container from an image you don't already have locally.
docker pull nginx:1.25
docker tag myapp:1.0 myusername/myapp:1.0
docker push myusername/myapp:1.0
Docker Hub — the default public registry
Unless configured otherwise, docker pull/docker push, and an unqualified FROM in a Dockerfile, default to Docker Hub. It hosts a few categories of images:
- Official images —
node,postgres,nginx,python, and similar. Curated and actively maintained, vetted by Docker. Usually the recommended starting point for a base image. - Verified Publisher images — published directly by the software vendor. For example, a database company publishing its own official image. This carries an extra trust signal beyond a purely community-contributed image.
- Community/user images — published by anyone with a Docker Hub account, with no particular vetting. Treat these with the same caution you'd use for an unfamiliar package from a public code registry with no reputation signal.
Why unqualified image names default to Docker Hub
FROM node:20 # implicitly: docker.io/library/node:20 (Docker Hub, official image)
FROM myorg/myapp:1.0 # implicitly: docker.io/myorg/myapp:1.0 (Docker Hub, user/org namespace)
An image reference with no registry hostname resolves against Docker Hub by default. This is just a configured default in the Docker daemon, not a hardcoded rule. To use a different registry, just include its hostname in the image reference.
Rate limiting — a real, practical Docker Hub consideration
Docker Hub limits pulls for anonymous and free-tier accounts. This occasionally shows up as mysterious ImagePullBackOff-style failures in CI pipelines or clusters that pull from many nodes in a short window. Authenticating with a Docker Hub account, even a free one, raises these limits substantially, and is a simple fix for pipelines hitting the limit.
Why organizations often move to a private or alternative registry
Public registries are the right default for genuinely public, open-source images. But proprietary application images generally shouldn't go on a public registry at all — both for confidentiality (source or build details can sometimes be inferred from image layers) and to avoid depending on a third-party public service's availability or rate limits for critical internal deployments.