s0sta
EN NL عربي
Filters
How to search
  • Plain words find names, texts and examples.
  • "two words" finds the exact phrase.
  • --name or -x finds an option.
  • #word looks only inside commands.
  • @grep finds lessons and labs that use grep.
  • Filters: cat:network · in:labs · in:notes · level:rhcsa · ch:8 · root:yes. Put ! before a word to leave it out. OR between words means one of them.
  • ↑ ↓ to move · Enter to open · Esc to close · / to search

Chapter 3Name in the course: Working with images and registries

Pull, tag, push and clean up images

Images move between your machine, CI and registries. This chapter covers pulling and inspecting images, tags and digests, logging in and pushing to a registry, saving images to files, and cleaning up disk space.

  • 6 Lessons
  • 6 Commands

$ run as a normal user# run as root (or with sudo)

3.1

Pull and inspect images

Pull by tag or by digest; inspect before you run.

docker pull nginx:1.27-alpine
docker images
docker image inspect nginx:1.27-alpine --format '{{.Os}}/{{.Architecture}} {{.Size}}'
docker pull nginx@sha256:DIGEST
docker images --digests nginx
skopeo inspect docker://docker.io/library/nginx:1.27-alpine

3.2

Tag images

A tag is another name for the same image. Tag for the registry you push to, with a version.

docker tag shop:dev ghcr.io/s0sta/shop:1.4.0
docker tag shop:dev ghcr.io/s0sta/shop:1.4
docker tag shop:dev ghcr.io/s0sta/shop:sha-3f2a9c1
Tag styleUse
1.4.0 (semver)Releases, never changed
1.4Moves to the newest 1.4.x
sha-3f2a9c1Exactly one commit, good for tracing
latestAvoid in production

3.3

Log in and push

Log in once per registry, then push.

echo "$GHCR_TOKEN" | docker login ghcr.io -u s0sta --password-stdin
docker push ghcr.io/s0sta/shop:1.4.0
az acr login -n acrshop2026
docker push acrshop2026.azurecr.io/shop:1.4.0
docker logout ghcr.io

Watch out

docker login stores the credential in ~/.docker/config.json (base64, not encrypted) unless a credential helper is set. On shared machines, log out after use.

3.4

Save and load images as files

For machines without registry access, save images into a tar archive.

docker save -o shop-1.4.0.tar ghcr.io/s0sta/shop:1.4.0
scp shop-1.4.0.tar admin@airgap1:/tmp/
docker load -i /tmp/shop-1.4.0.tar
skopeo copy docker://ghcr.io/s0sta/shop:1.4.0 oci-archive:shop.tar

3.5

Clean up disk space

Old images, stopped containers and build cache fill the disk fast on build servers.

docker system df
docker image prune -f
docker image prune -a --filter "until=168h" -f
docker builder prune -f
docker system prune -f
docker volume prune -f

Watch out

docker volume prune deletes data of volumes no container uses right now. Check docker volume ls first.

3.6

Run your own registry

For labs or isolated networks, run a small registry yourself. In companies, use ACR, GHCR, Harbor or Nexus with access control and scanning.

docker run -d --name registry -p 5000:5000 -v registry-data:/var/lib/registry registry:2
docker tag shop:dev localhost:5000/shop:dev
docker push localhost:5000/shop:dev
curl -s http://localhost:5000/v2/_catalog

All commands in this chapter