This page shows how to create a Pod that uses a Secret to pull an image from a private Docker registry or repository. Before you begin You need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster. If you do not already have a cluster, you can create one by using minikube or you can use one of these Kubernetes playgrounds. For example, rather than installing dependencies and packages separately to use Docker, developers can download a compressed image from a registry that contains all of the necessary components. Furthermore, developers can automate pushing images to a registry using continuous integration tools, such as TravisCI, to seamlessly update images.

A Docker image is a read-only template that defines your container. The image contains the code that will run including any definitions for any libraries and dependancies your code needs. A Docker container is an instantiated (running) Docker image. AWS provides Amazon Elastic Container Registry (ECR), an image registry for storing and quickly. Caddy 2 is a powerful, enterprise-ready, open source web server with automatic HTTPS written in Go.

Estimated reading time: 5 minutes

Docker has enabled download rate limits for pull requests on Docker Hub. Limits are determined based on the account type. For more information, see Resource Consumption FAQs and Docker Hub Pricing.

A user’s limit will be equal to the highest entitlement of theirpersonal account or any organization they belong to. To take advantage of this, you must log into Docker Hub as an authenticated user. For more information, seeHow do I authenticate pull requests. Unauthenticated (anonymous) users will have the limits enforced via IP.

• A pull request is defined as up to two GET requests on registry manifest URLs (/v2/*/manifests/*).
• A normal image pull makes a single manifest request.
• A pull request for a multi-arch image makes two manifest requests.
• HEAD requests are not counted.
• Limits are applied based on the user doing the pull, and not based on the image being pulled or its owner.

Docker will gradually introduce these rate limits starting November 2nd, 2020.

How do I know my pull requests are being limited

When you issue a pull request and you are over the limit for your account type, Docker Hub will return a 429 response code with the following body when the manifest is requested:

You will see this error message in the Docker CLI or in the Docker Engine logs.

How can I check my current rate

Valid manifest API requests to Hub will usually include the following rate limit headers in the response:

These headers will be returned on both GET and HEAD requests. Note that using GET emulates a real pull and will count towards the limit; using HEAD will not, so we will use it in this example. To check your limits, you will need curl, grep, and jq installed.

To get a token anonymously (if you are pulling anonymously):

To get a token with a user account (if you are authenticating your pulls) - don’t forget to insert your username and password in the following command:

Then to get the headers showing your limits, run the following:

Which should return headers including these:

This means my limit is 100 per 21600 seconds (6 hours), and I have 76 pulls remaining.

Remember that these headers are best-effort and there will be small variations.

I don’t see any RateLimit headers

If you do not see these headers, that means pulling that image would not count towards pull limits. This could be because you are authenticated with a user associated with a Legacy/Pro/Team Docker Hub account, or because the image or your IP is unlimited in partnership with a publisher, provider, or open source organization.

How do I authenticate pull requests

The following section contains information on how to log into on Docker Hub to authenticate pull requests.

Docker Desktop

If you are using Docker Desktop, you can log into Docker Hub from the Docker Desktop menu.

Click Sign in / Create Docker ID from the Docker Desktop menu and follow the on-screen instructions to complete the sign-in process.

Docker Engine

If you are using a standalone version of Docker Engine, run the docker login command from a terminal to authenticate with Docker Hub. For information on how to use the command, see docker login.

Docker Swarm

If you are running Docker Swarm, you must use the -- with-registry-auth flag to authenticate with Docker Hub. For more information, see docker service create. If you are using a Docker Compose file to deploy an application stack, see docker stack deploy.

GitHub Actions

If you are using GitHub Actions to build and push Docker images to Docker Hub, see login action. If you are using another Action, you must add your username and access token in a similar way for authentication.

Kubernetes

If you are running Kubernetes, follow the instructions in Pull an Image from a Private Registry for information on authentication.

Third-party platforms

If you are using any third-party platforms, follow your provider’s instructions on using registry authentication.

Other limits

Docker Hub also has an overall rate limit to protect the application and infrastructure. This limit applies to all requests to Hub properties including web pages, APIs, image pulls, etc. The limit is applied per-IP, and while the limit changes over time depending on loadand other factors, it is in the order of thousands of requests per minute. The overall rate limit applies to all users equallyregardless of account level.

You can differentiate between these limits by looking at the error code. The “overall limit” will return a simple 429 Too Many Requests response. The pull limit returns a longer error message thatincludes a link to this page.

Estimated reading time: 7 minutes

Docker Hub repositories allow you share container images with your team,customers, or the Docker community at large.

Docker images are pushed to Docker Hub through the docker pushcommand. A single Docker Hub repository can hold many Docker images (stored astags).

Creating repositories

Docker Registry Download Image Curl

To create a repository, sign into Docker Hub, click on Repositories thenCreate Repository:

Download Docker Registry Images

When creating a new repository:

• You can choose to put it in your Docker ID namespace, or in anyorganization where you are an owner.
• The repository name needs to be unique in that namespace, can be twoto 255 characters, and can only contain lowercase letters, numbers, hyphens (-),and underscores (_).
• The description can be up to 100 characters and is used in the search result.
• You can link a GitHub or Bitbucket account now, or choose to do it later inthe repository settings.

After you hit the Create button, you can start using docker push to pushimages to this repository.

Docker Registry Download Image Software

Pushing a Docker container image to Docker Hub

To push an image to Docker Hub, you must first name your local image using yourDocker Hub username and the repository name that you created through Docker Hubon the web.

You can add multiple images to a repository by adding a specific :<tag> tothem (for example docs/base:testing). If it’s not specified, the tag defaultsto latest.

Name your local images using one of these methods:

• When you build them, using docker build -t <hub-user>/<repo-name>[:<tag>]
• By re-tagging an existing local image docker tag <existing-image> <hub-user>/<repo-name>[:<tag>]
• By using docker commit <existing-container> <hub-user>/<repo-name>[:<tag>]to commit changes

Now you can push this repository to the registry designated by its name or tag.

The image is then uploaded and available for use by your teammates and/orthe community.

Private repositories

Private repositories let you keep container images private, either to yourown account or within an organization or team.

To create a private repository, select Private when creating a repository:

You can also make an existing repository private by going to its Settings tab:

You get one private repository for free with your Docker Hub user account (notusable for organizations you’re a member of). If you need more privaterepositories for your user account, upgrade your Docker Hub plan from yourBilling Information page.

Once the private repository is created, you can push and pull images to andfrom it using Docker.

Note: You need to be signed in and have access to work with aprivate repository.

Note: Private repositories are not currently available to search throughthe top-level search or docker search.

You can designate collaborators and manage their access to a privaterepository from that repository’s Settings page. You can also toggle therepository’s status between public and private, if you have an availablerepository slot open. Otherwise, you can upgrade yourDocker Hub plan.

Collaborators and their role

A collaborator is someone you want to give access to a private repository. Oncedesignated, they can push and pull to your repositories. They are notallowed to perform any administrative tasks such as deleting the repository orchanging its status from private to public.

Note

A collaborator cannot add other collaborators. Only the owner ofthe repository has administrative access.

You can also assign more granular collaborator rights (“Read”, “Write”, or“Admin”) on Docker Hub by using organizations and teams. For more informationsee the organizations documentation.

Viewing repository tags

Docker Hub’s individual repositories view shows you the available tags and thesize of the associated image. Go to the Repositories view and click on arepository to see its tags.

Image sizes are the cumulative space taken up by the image and all its parentimages. This is also the disk space used by the contents of the .tar filecreated when you docker save an image.

To view individual tags, click on the Tags tab.

An image is considered stale if there has been no push/pull activity for morethan 1 month, i.e.:

• It has not been pulled for more than 1 month
• And it has not been pushed for more than 1 month

A multi-architecture image is considered stale if all single-architecture imagespart of its manifest are stale.

To delete a tag, select the corresponding checkbox and select Delete from theAction drop-down list.

Note

Only a user with administrative access (owner or team member with Adminpermission) over the repository can delete tags.

Select a tag’s digest to view details.

Searching for Repositories

You can search the Docker Hub registry through itssearch interface or by using the command line interface. Searching can findimages by image name, username, or description:

There you can see two example results: centos and ansible/centos7-ansible.The second result shows that it comes from the public repository of a user,named ansible/, while the first result, centos, doesn’t explicitly list arepository which means that it comes from the top-level namespace forofficial images. The / character separatesa user’s repository from the image name.

Once you’ve found the image you want, you can download it with docker pull <imagename>:

You now have an image from which you can run containers.

Starring Repositories

Your repositories can be starred and you can star repositories in return. Starsare a way to show that you like a repository. They are also an easy way ofbookmarking your favorites.

Service accounts

A service account is a Docker ID used by a bot for automating the build pipelinefor containerized applications. Service accounts are typically used in automatedworkflows, and do not share Docker IDs with the members in the Team plan.

To create a new service account for your Team account:

1. Create a new Docker ID.
2. Create a team in your organization and grant it read-only access to your private repositories.
3. Add the new Docker ID to your organization.
4. Add the new Docker ID to the team you created earlier.
5. Create a new personal access token (PAT) from the user account and use it for CI.

To create a new service account for your Pro account:

1. Create a new Docker ID.
2. Click Repositories from the main menu.
3. Select a repository from the list and go to the Collaborators tab.
4. Add the new Docker ID as a collaborator.
5. Create a new personal access token (PAT) from the user account and use it for CI.

If you want a read-only PAT just for your open source repos, or to accessofficial images and other public images, you do not have to grant any access permissions to the new Docker ID.

Note

Service accounts are still subject to Docker’s fair pull limit policy. To learn more about these limits, see our Resource Consumption Updates FAQ.