Images, tags and registries

By the end of this module, you should be able to:

• Read image references such as repository:tag and registry/repository:tag.
• Explain the difference between a mutable tag and an immutable content digest.
• Inspect image metadata and layer history.

Image references identify artifacts

A familiar reference such as nginx:alpine combines a repository name with a tag. When a registry hostname is omitted, Docker uses its configured/default registry conventions. Tags are human-friendly labels and can be moved to point at a different image over time.

A digest identifies image content by cryptographic hash and is therefore useful when you need an immutable reference.

Images are layered

Docker images are assembled from filesystem layers plus configuration metadata. Layers can be shared between images, reducing duplicate transfer and storage when content is identical. Image history helps explain how a Dockerfile produced the artifact, although it is not a complete security record.

Registries distribute images

docker pull retrieves an image, docker push uploads a tagged image when you are authenticated and authorized, and docker image tag creates another local reference to the same image content. Production pipelines commonly push versioned images to an organizational registry instead of building directly on production hosts.

See the idea in practice.

docker pull nginx:alpine
docker image inspect nginx:alpine --format '{{.Id}} {{json .RepoDigests}}'
docker history nginx:alpine

docker image tag nginx:alpine local/nginx-training:1.0
docker image ls local/nginx-training:1.0

Common mistakes

• Assuming latest means newest or safe.
• Using only mutable tags when reproducible deployment requires an immutable artifact.
• Embedding registry credentials into a Dockerfile.