Stop 09 · Containers & OrchestrationTopics · 2/9

Container Registries

In short

You built an image on your laptop. Your server and CI need the exact same image. A registry is where images are uploaded once and pulled anywhere.

Storing and distributing Docker images — cloud providers offer managed private registries (ECR, GCR, ACR) tightly integrated with their compute and orchestration services.

The blob on a rolling ladder lifts down one sealed box from tall shelves of tagged boxes.

Think of it like this

The central godown

A brand doesn't ship sweets from its kitchen to every shop. Boxes go to a central godown, each labelled with batch and date. Any shop orders the exact batch it wants. A registry is that godown, and image tags are the batch labels.

Watch it happen

Build once, run anywhere

Laptop or CI

Registry

Server

build api:1.4.0

1/5The image is tagged with the registry address, your account and a version, like ghcr.io/riya/chai-api:1.4.0.

The big ideas

What you need to know

Many registries

Docker Hub, GitHub Container Registry, AWS ECR and Google Artifact Registry all store images the same way.

Tag with versions

Use version numbers or git commit SHAs. latest moves around, so you can't tell what's actually running.

Private by default for work

Company images belong in private repositories. Pull them with tokens that have only read access.

Let CI push

Build and push from CI on every merge, so images come from the same clean process every time.

See it in code

Walk through the code

bash

1# Name the image with registry/user/repo:tag2docker build -t ghcr.io/riya/chai-api:1.4.0 .3 4# Log in once (use a token, not your password)5echo "$GHCR_TOKEN" | docker login ghcr.io -u riya --password-stdin6 7# Upload it8docker push ghcr.io/riya/chai-api:1.4.09 10# On the server: download and run the exact same image11docker pull ghcr.io/riya/chai-api:1.4.012docker run -d -p 80:3000 ghcr.io/riya/chai-api:1.4.0

1/4The image name includes where it will live. Without a registry host, Docker assumes Docker Hub.

--password-stdin keeps the token out of your shell history. For GitHub's registry, a token with package read and write scope works.

Save yourself the pain

Common mistakes

Oops

Deploying with :latest and wondering which version is live.

Do this instead

Deploy explicit tags like 1.4.0 or a commit SHA. Rolling back is then just running the old tag.

Oops

Pushing an image that has .env baked in to a public repo.

Do this instead

Anyone can pull it and read every layer. Keep secrets out of images entirely.

Your mission

Push your first image

~25 min

Quick check

Why is deploying a fixed tag like 1.4.0 better than latest?

Go deeper

1Push an image you've built to your cloud provider's managed registry.
2Learn to tag images meaningfully (version numbers, not just `latest`) before pushing.
3Understand why private registries matter for any non-open-source application.