Private Registries

Run your own registry or use a private cloud registry to keep proprietary images secure and access-controlled.

Syntaxdocker run -d -p 5000:5000 --name registry registry:2

Not every image should be public. A private registry keeps your proprietary images restricted to authorized users.

Options

  • Private repos on Docker Hub — mark a repository private.
  • Cloud registries — ECR, GCR/Artifact Registry, ACR, with IAM-based access.
  • Self-hosted — run the open-source registry image on your own infrastructure.

Running your own

Docker provides an official registry image. You start it like any container, then tag and push images using your registry's host and port.

Example

Example · bash
# Run a local registry on port 5000
docker run -d -p 5000:5000 --name registry registry:2

# Tag and push an image to it
docker tag myapp:1.0 localhost:5000/myapp:1.0
docker push localhost:5000/myapp:1.0

# Pull it back from the local registry
docker pull localhost:5000/myapp:1.0

When to use it

  • A startup runs the official registry:2 container on a private server to host proprietary images without paying for a cloud registry.
  • An enterprise uses AWS ECR as a private registry so images are stored in the same region as ECS/EKS workloads, reducing pull latency.
  • A team configures the Docker daemon to trust an internal self-signed registry so developers can push and pull without TLS errors.

More examples

Run a local private registry

Starts the official Docker registry on port 5000 with a named volume so pushed images persist.

Example · bash
docker run -d \
  --name registry \
  -p 5000:5000 \
  -v registrydata:/var/lib/registry \
  registry:2

Push an image to the local registry

Tags the image with the local registry address and pushes it, then confirms with the registry's REST API.

Example · bash
docker tag myapp:1.0 localhost:5000/myapp:1.0
docker push localhost:5000/myapp:1.0

# Verify it was stored
curl http://localhost:5000/v2/myapp/tags/list

Log in to AWS ECR

Authenticates to AWS ECR using the CLI and then pushes an image to the private repository.

Example · bash
aws ecr get-login-password --region us-east-1 \
  | docker login --username AWS --password-stdin \
    123456789.dkr.ecr.us-east-1.amazonaws.com

docker push 123456789.dkr.ecr.us-east-1.amazonaws.com/myapp:1.0

Related

docker push pulldocker image scanning

Discussion

  • Be the first to comment on this lesson.