Container Registry

Q: Why should I avoid the latest tag in production?

The latest tag is just a label that moves whenever someone pushes a new image, so two servers can end up running different code under the same name. Using a specific version tag or a digest makes deployments predictable and easy to roll back.

Updated September 30, 20262 min read

In short

A container registry is a storage and distribution service for container images, letting teams push built images and pull them onto any server that runs them.

What is a container registry?

A container registry is a server that stores container images and hands them out on request. After a build pipeline creates an image, it pushes the image to the registry, and later every machine that needs to run it, such as a Kubernetes node, pulls it from there. Registries can be public, so anyone can download images, or private, so only authenticated users and systems can access them.

Images inside a registry are organized into repositories, such as myteam/web-app, and each version is labeled with a tag, such as 1.4.0 or latest. Every image also has a digest, a SHA-256 hash of its contents, which identifies it exactly even if a tag is later moved to a different image. Most registries follow the Open Container Initiative (OCI) distribution specification, so standard tools can push to and pull from any of them, and many also scan images for known vulnerabilities.

A container registry is like an app store for your servers: developers publish packaged software once, and any machine can download the exact version it needs. Registries are a core part of CI/CD pipelines, and many organizations run a private registry close to their clusters for speed, access control, and protection from outages or download limits of public registries.

People often mix up the registry, the repository, and the image. The registry is the whole service, a repository is a named collection of related images inside it, and an image is one specific build identified by a tag or digest. A container registry is also different from a Git repository, which stores source code rather than the built, runnable images made from it.

Key takeaways

A registry stores container images and serves them to the machines that run them.
Images are grouped into repositories and versioned with tags.
A digest identifies an image's exact contents and cannot be moved like a tag.
Private registries control who can push and pull images.
Most registries follow the OCI distribution specification.

Example

Pushing and pulling an imagebash

# Build an image and tag it with the registry address and version
docker build -t registry.example.com/myteam/web-app:1.4.0 .

# Log in and push the image to the registry
docker login registry.example.com
docker push registry.example.com/myteam/web-app:1.4.0

# On any other machine, pull the exact same image
docker pull registry.example.com/myteam/web-app:1.4.0

# Pin by digest for a fully reproducible deployment
docker pull registry.example.com/myteam/web-app@sha256:<digest>

Readers ask

What is the difference between a container registry and a repository?

A registry is the whole service that hosts images, while a repository is one named collection inside it, such as myteam/web-app, that holds the different tagged versions of that image.

Why should I avoid the latest tag in production?

The latest tag is just a label that moves whenever someone pushes a new image, so two servers can end up running different code under the same name. Using a specific version tag or a digest makes deployments predictable and easy to roll back.

Can I run my own container registry?

Yes. Open-source registry servers can be self-hosted, and most cloud providers and code hosting platforms also offer managed private registries with built-in access control.