Registry & Distribution

docker login [registry]
docker login -u <username> <registry>

docker login
docker login ghcr.io
docker login registry.example.com -u deploy-bot

Login Succeeded

Note Without a registry argument, Docker logs into Docker Hub. Credentials are stored in ~/.docker/config.json — often in plain text unless you configure a credential helper. Set up a credential store for production machines.

docker tag <local_image> <registry>/<repo>:<tag>
docker push <registry>/<repo>:<tag>

docker build -t myapp:1.0 .
docker tag myapp:1.0 ghcr.io/myorg/myapp:1.0
docker tag myapp:1.0 ghcr.io/myorg/myapp:latest
docker push ghcr.io/myorg/myapp:1.0
docker push ghcr.io/myorg/myapp:latest

Note Always push a specific version tag alongside latest. This way, deployments can pin to a known version while latest serves as a convenience pointer for development.

<image>:<version>
<image>:<version>-<variant>

myapp:2.1.0
myapp:2.1.0-alpine
myapp:2.1
myapp:latest
myapp:main-abc1234

Note Common patterns: semver (2.1.0), major.minor (2.1), variant suffix (-alpine, -slim), git-based (main-abc1234, sha-abc1234). Never rely on :latest in production — it is a mutable tag and gives you no way to reproduce a specific build.

docker run -d -p 5000:5000 --name registry registry:2

docker run -d -p 5000:5000 --restart always --name registry registry:2
docker tag myapp:1.0 localhost:5000/myapp:1.0
docker push localhost:5000/myapp:1.0
docker pull localhost:5000/myapp:1.0

Note This runs a minimal private registry. For production, add TLS certificates and authentication. Docker refuses to push to non-HTTPS registries by default — add the registry to the insecure-registries list in daemon.json only for local testing.

docker buildx build --platform <platforms> -t <tag> [--push] .

docker buildx create --name multiarch --use
docker buildx build \
  --platform linux/amd64,linux/arm64 \
  -t ghcr.io/myorg/myapp:1.0 \
  --push .

Note Builds images for multiple architectures in one command. The --push flag is required because multi-platform images cannot be loaded into the local daemon (they are a manifest list, not a single image). You need QEMU emulation configured for non-native platforms.

docker manifest inspect <image>

docker manifest inspect node:20-alpine
docker buildx imagetools inspect ghcr.io/myorg/myapp:1.0

Note Shows which platforms an image supports without pulling the entire image. Useful for verifying that your multi-platform build actually produced the architectures you expected.