Lesson 9 of 30 intermediate 4 min read

Before this:Writing a Dockerfile

Images & registries

Key takeaways A container image is named registry/name:tag. A registry (Docker Hub, GitHub’s ghcr.io) stores and distributes images: you push from where you built, and any host pulls to deploy. A tag (:latest, :1.4.2) is a movable label; a digest is an immutable hash of the exact bytes. Pull-and-run makes deploying somewhere new a one-liner.

You’ve built an image. Now how do you get it onto a server? Through a registry — this lesson covers naming, storing, and sharing images.

How images are named

A full image name has three parts:

   ghcr.io/mattcheramie/gophertrunk : latest
   \______/ \___________________/    \____/
   registry        repository          tag
  • registry — where it lives (docker.io for Docker Hub, ghcr.io for GitHub’s container registry). Omit it and Docker assumes Docker Hub.
  • repository — the image’s name, usually owner/project.
  • tag — which version, like latest, 1.4.2, or dev.

Tags vs digests

A tag is a friendly, movable label — :latest points at whatever you last pushed as latest. That’s convenient but means “latest” is a moving target. A digest (sha256:...) is a hash of the image’s exact contents; it never moves, so pinning to a digest guarantees you run the identical bytes you tested — the immutability idea from artifacts & versioning applied to images.

Push and pull

Sharing an image is two commands. From where you built it:

docker tag gophertrunk:dev ghcr.io/mattcheramie/gophertrunk:1.4.2
docker push ghcr.io/mattcheramie/gophertrunk:1.4.2

And on any machine you want to deploy on:

docker pull ghcr.io/mattcheramie/gophertrunk:1.4.2
docker run ghcr.io/mattcheramie/gophertrunk:1.4.2

That pull + run is the whole deploy step — no build tools, no dependencies to install on the target, just fetch the image and start it. This is the payoff of containerizing: deploying somewhere new is a one-liner.

build machine push registry pull server A server B
Build once, push to a registry, pull the identical image onto any number of servers.

A note on GopherTrunk

GopherTrunk’s docker-compose file references the image name ghcr.io/mattcheramie/gophertrunk, but by default you build it locally from the repo Dockerfile (docker compose build). GopherTrunk’s official automated releases are downloadable binaries and installers rather than a pushed image — a good reminder that “artifact” can mean a container image or a plain binary, and a project can use whichever fits.

Quick check: what does a container registry let you do?

Recap

  • An image is named registry/repository:tag; omit the registry and Docker Hub is assumed.
  • A tag is a movable label; a digest is an immutable hash of exact contents.
  • push to a registry, pull on any host — pull-and-run is the whole deploy.
  • GopherTrunk’s compose builds the image locally; its official releases are binaries.

Next up: running an app plus its dependencies together with Docker Compose.

Frequently asked questions

What is a container registry?

A registry is a server that stores and distributes container images, like a package repository for containers. You push an image to it from wherever you built it, and any machine you want to deploy on pulls it back down. Docker Hub and GitHub’s ghcr.io are common public registries.

What is the difference between an image tag and a digest?

A tag is a human-friendly label like :latest or :1.4.2 that you attach to an image and can move to point at a new build. A digest is a cryptographic hash of the exact image contents — it never changes and always refers to the identical bytes. Use tags for convenience, digests when you need to pin an exact, immutable image.