What Is Docker Hub? A Guide to Docker Image Registry

Run docker pull on a plain image name and the request goes to Docker Hub. Nobody sets that up. It’s simply where Docker looks first.

Docker Hub is a cloud based container registry run by Docker Inc, and it stores and hands out container images for solo developers and large organizations alike. Public and private repositories live side by side. It sits behind Docker Engine and Docker Desktop by default, and Compose files rely on it too.

Docker curates 181 Docker Official Image repositories there itself, rather than leaving them to individual maintainers (Docker Hub, 2026).

What Is Docker Hub?

Mostly it is a very large shelf of repositories. Each repository holds one image name plus every tag pushed to it, and almost anyone can add to the shelf, which is both the appeal and the risk.

Docker Inc runs the container registry that most people meet first, and the repositories on it come in a few flavors. Public ones can be pulled without an account. Private ones are limited to a Docker ID or an organization. Docker Official Images get their own reviewed group. Then there are automated build repositories tied to a source code host, although that feature is on its way out (covered further down).

Docker Hub doesn’t replace anything else in the toolchain. A plain docker pull from Docker Engine or Docker Desktop talks to it automatically, and Compose files reference the same repository names.

How Does Docker Hub Work?

Under the hood it’s a client server setup built on the open source Docker Registry project. Layers go in, and layers come back out on request.

The Docker CLI does the talking. It authenticates, uploads or downloads layers, and Docker Hub indexes each layer by its content hash, so an identical layer never gets stored twice.

A typical push goes like this. The CLI builds a local Docker image from a Dockerfile, logs in, and pushes the image layer by layer. Docker Hub stores those layers and updates the repository’s tag list. After that, any client anywhere can pull the same layers back down.

Running the image is a separate job. Docker Engine, and the containerd runtime underneath it, takes a pulled image and starts a container from it.

Kubernetes follows the same pattern. A pod spec names an image and a tag, and the node’s runtime pulls it from Docker Hub the first time that node needs it.

Compose does the same thing on a smaller scale. A Docker compose file just lists image names, and they get pulled the moment you bring the stack up.

Docker Hub vs Docker Registry Software

Docker Registry is the open source server software. Docker Hub is Docker’s own hosted, commercial service built on top of it.

You can run the Registry software on your own servers, but you get none of Docker Hub’s web interface, search or official image curation. It’s bare bones on purpose.

Teams that want a private, self managed option usually pick Docker Registry, Harbor, or a cloud vendor’s registry, and skip paying for Docker Hub seats.

Official Images and Verified Publisher Repositories

Docker reviews and maintains the Official Images together with the upstream project behind each one. Right now 181 Docker Official Image repositories are listed on Docker Hub, spanning languages, databases and infrastructure tools (Docker Hub, 2026).

Alpine Linux is the minimal base image that shows up in a huge number of Dockerfiles. Ubuntu is the usual general purpose base. Nginx is an official build maintained with the upstream Nginx team, and Postgres and Python both have dedicated maintainers too.

The Verified Publisher badge is a separate thing. It tells you a commercial organization owns and publishes that repository, and not some individual maintainer.

Community images carry neither label. Anyone with a Docker ID can push one, and nobody at Docker looks at its Dockerfile or checks how often it gets updated. Plenty of them are fine. Some are abandoned, and a few are worse than abandoned.

The upside of sticking to official and verified images is fairly plain. The Dockerfiles are reviewed and follow documented build practices, updates track upstream releases, and you’re less likely to pull something dead or malicious.

The downside is that you give up some flexibility. A hand rolled community image can be customized further, official builds are slower to pick up bleeding edge upstream changes, and some tools and frameworks just don’t have an official image at all.

How Does Image Versioning Work on Docker Hub?

There’s no single version number field. Docker Hub versions images through tags, digests and manifest lists.

A tag is a human readable label like 3.12 or latest that points at one specific build. A digest is a content hash of the image, unique to that exact set of layers, and it never changes once published. Manifest lists are the quieter piece. One tag can group several architecture specific builds, so amd64 and arm64 users pull the same tag and each get the right binary.

The latest tag is not a version number, whatever it looks like. It’s a moving pointer, and it can silently point at a different build overnight.

Teams that care about reproducible builds tend to follow semantic versioning in their tag names, then pin production deployments to a digest instead of a tag.

Pinning to a digest means a redeploy months later pulls the exact same bytes, not whatever the tag happens to point at by then.

Docker Hub Account and Organization Structure

Every account starts as a personal Docker ID. Larger teams add an organization account on top of that.

A Docker ID owns its own repositories and its own billing. An organization account groups several people under shared repositories and one shared bill.

Organization accounts also add named teams that map to real departments or squads, per repository role assignment instead of all or nothing access, and billing tied to the organization, so nobody’s personal card is on the hook.

Personal Docker IDs are fine for solo projects. The organization account earns its keep the day a second person needs to push to the same repository.

Docker Hub Pricing Plans and Pull Rate Limits

The free Personal tier limits private repositories and pulls, and each paid plan lifts both.

The numbers worth remembering are these. Unauthenticated pulls are capped at 100 per 6 hours per IPv4 address or IPv6 /64 subnet (Docker Documentation, 2026), and authenticated Personal pulls at 200 per 6 hours (Docker Documentation, 2026). Pro costs $9 per user per month billed annually (Docker, 2026), Team costs $15 on the same terms (Docker, 2026), and Business is $24 per user per month (Docker, 2026).

Anonymous scripts hit the wall first. A CI job that pulls the same base image on every run inside a shared build pipeline can burn through 100 unauthenticated pulls in one busy window, because every runner behind the same IP address shares that single allowance.

Logging in with a Docker ID before pulling doubles the ceiling to 200 pulls per 6 hours at no extra cost. It also makes the limit per account instead of per IP address, which is why most CI setups authenticate even on the free tier.

How Do Automated Builds Work on Docker Hub?

Heads up: Docker Hub Automated Builds is deprecated. It’s only available on the Pro, Team and Business plans, and Docker will fully retire it on April 1, 2027 (Docker Documentation, 2026). New projects should build images in an external CI/CD workflow and push them to Docker Hub instead.

The idea was simple. Link a Docker Hub repository to a source code host, and pushing code rebuilds the image with no one running docker build by hand.

1. Connect a GitHub or Bitbucket repository to a Docker Hub repository
2. Define a build rule that names the Dockerfile path and the build context
3. Push a commit or tag that matches the configured trigger
4. Docker Hub builds the image and publishes it under the matching tag
5. A webhook fires to notify any connected system that a new build finished

A build rule maps a branch or tag pattern to a specific Dockerfile and output tag. The build context is the folder sent to the builder, and it decides what COPY and ADD instructions can see. The webhook is an outbound call Docker Hub makes once a build completes, and it’s often used to kick off a deployment step somewhere else.

With the retirement date set, teams running GitHub Actions next to Docker Hub increasingly build inside the Actions workflow and push images straight from there. That’s also the migration path Docker points to.

Either way, the ending looks the same. A finished build fires a webhook, and whatever is listening on the other end (a deploy script, a Slack channel, another pipeline) picks up from there.

What Security Scanning Does Docker Hub Provide?

Docker Hub checks hosted images for known vulnerabilities through Docker Scout, its built in image analysis service. Scout pulls data from more than 20 advisory sources, including the National Vulnerability Database and the GitHub Advisory Database (Docker Documentation, 2026).

The process is mechanical. Scout extracts a full software bill of materials (SBOM) from each image, then cross references every package in it against live CVE advisories. Severity and a fixed version, if one exists, show up right on the Docker Hub repository page.

How much you get depends on your subscription tier, not on the image.

Scout isn’t the only choice. Trivy is a free standalone scanner that lives outside the Docker ecosystem, and Snyk pairs container scanning with source code and dependency checks in the same CI run.

Teams already deep in the Docker toolchain lean on Scout because there’s nothing to set up. If you’re scanning more than container images, say infrastructure as code or running clusters, you’ll probably bring in Trivy or Snyk next to it.

How Do You Push and Pull Images With Docker Hub?

Both directions run through the Docker CLI, and the sequence barely changes once you’ve done it a few times.

1. Run docker login and authenticate with a Docker ID or a personal access token
2. Tag the local image so its name matches the target Docker Hub repository
3. Push the image with docker push, which uploads only the layers Docker Hub doesn’t already have
4. Confirm the new tag shows up on the repository page in Docker Hub
5. Pull the same image elsewhere with docker pull, naming the exact tag or digest
6. Reference that image name in a Compose file or a Kubernetes manifest to run it

Step three is where most of the time goes. Layer size decides how long a push takes, and on a slow connection that gets painful.

If you can’t keep the syntax in your head, a Docker cheat sheet covers tagging, pushing and pulling in one place.

Authenticating With a Personal Access Token

A personal access token is a generated credential that stands in for your Docker Hub password on the CLI. You can scope it to read, write or delete, unlike a password that grants everything. It can be revoked on its own without touching the account password, and any CI system that logs in without a human typing credentials needs one.

Docker recommends token-based authentication for every automated docker login. Keep the account password for interactive use only.

Docker Hub vs Other Container Registries

AWS, GitHub and Red Hat each ship a registry as part of a bigger platform, and those are Docker Hub’s real competition.

GitHub’s billing documentation says container image storage and bandwidth for GitHub Container Registry are currently free, with at least one month’s notice promised before that changes (GitHub, 2026).

Amazon ECR skips per user pricing altogether. Storage runs $0.10 per GB per month with no plan based pull cap, since AWS bills by usage instead of by seat, and data transfer is billed separately (AWS, 2026).

Docker Hub’s edge is the widest base image selection and the deepest tooling integration, and it’s the registry every Dockerfile FROM line falls back to. The others win in narrower cases. GitHub Container Registry suits teams already living in GitHub Actions, and Amazon ECR fits AWS heavy workloads. Quay.io makes sense for shops running Kubernetes vs Docker style OpenShift deployments.

All four store images in the same Open Container Initiative format, so an image built for one registry runs unmodified after you push it to another.

When Docker Hub Does Not Fit Your Workflow

Docker Hub breaks down in a few predictable situations, and none of them are edge cases. CI pipelines that pull the same base image thousands of times a day blow past the free tier’s six hour ceiling. Regulated industries may need image data kept inside a specific country or cloud region. Air gapped networks have no outbound path to reach Docker Hub at all. And some organizations need audit logging or retention policies beyond what the Business plan exposes.

Compliance and residency is the one that catches people. Financial services and healthcare teams often can’t meet software compliance requirements with a registry hosted outside their contracted regions, which pushes them toward a self hosted Docker Registry or a cloud vendor’s regional service.

Air gapped environments are simpler to describe. Defense and industrial control networks often run with zero outbound connectivity, so images get mirrored in physically or through a one way transfer, and never pulled live.

Docker Hub’s plans also stop short of the custom retention schedules and detailed access logs that some compliance frameworks require by name.

None of this makes Docker Hub unsuitable in general. High volume CI, regulated data and offline networks each just call for a different registry running next to it, not instead of it.

Teams shipping app deployment pipelines at real scale usually end up with Docker Hub for development and a private or cloud native registry for production, rather than one registry for everything.

FAQ on What Is Docker Hub

What Is a Docker ID?

It’s the unique username tied to a personal Docker Hub account.

It authenticates docker login on the CLI and owns personal repositories. It can later join one or more organization accounts without losing its own private repository.

What Is the Docker Hub API Used For?

Scripts and tools use it to query repository data programmatically instead of clicking through the web interface.

Teams use it to list tags, check image digests, automate repository creation, or pull vulnerability scan results into a separate dashboard.

What Is the Docker Sponsored Open Source Program?

Approved non-commercial open source projects get unlimited pulls and egress for the public images in their namespace, plus a free one year Docker Team subscription for the project’s core contributors.

Maintainers apply directly, and Docker reviews project activity before granting the sponsored status. Benefits run for one year and renew while the project stays active and eligible.

What Error Appears When You Hit a Docker Hub Pull Rate Limit?

You get a 429 Too Many Requests response, which usually shows in the CLI as toomanyrequests: You have reached your pull rate limit.

Authenticating with a Docker ID before pulling, or upgrading past the free tier, raises the ceiling and clears the block.

What Happens to Inactive Images on Docker Hub’s Free Plan?

In 2020 Docker announced that images in free repositories with no pull or push for six months would be marked inactive and scheduled for deletion, while paid plans would be exempt. Docker then paused enforcement of that policy, so check Docker’s current terms of service before relying on either outcome.

Teams relying on rarely updated base images often upgrade, or pull them on a schedule, to stay clear of the policy.

Can You Use Docker Hub Without Creating an Account?

Yes, for pulling. Anonymous pulls work for public repositories with no Docker ID, subject to the unauthenticated pull rate limit.

Pushing an image, creating a private repository, or raising the pull ceiling all require signing in.

What Should You Set Up First When Adopting Docker Hub?

Authentication comes before picking a plan. Create a Docker ID, log in from the CLI, and let every pull run authenticated from day one.

That one step removes the most common failure teams hit in their first month. Authenticate every CI runner before you scale pull volume, and pin production deployments to a digest, not a tag. A private or self hosted registry can wait until compliance demands it.

Jumping straight to a paid plan without fixing authentication wastes money on a problem a free Docker ID already solves.

There is a real trade off here. Staying on the free tier keeps the cost at zero, but CI pipelines stay exposed to throttling the moment traffic spikes.

Teams that outgrow that exposure move workloads to a paid tier or a parallel registry, and not away from Docker Hub entirely.

If you want a natural next read, see where Docker images are stored once they leave the registry and land on a running host.

• Author
• Recent Posts

Bogdan Sandu

Bogdan Sandu is a front-end developer at TMS Outsource with 8+ years of experience in web technologies. He writes about developer tools, software platforms, and web workflows based on daily hands-on use.

Latest posts by Bogdan Sandu (see all)

• How to Turn On Dark Mode in Notepad++ (Built-In, No Plugin) - October 3, 2026
• PostgreSQL Cheat Sheet - October 2, 2026
• How to Repair a Corrupt SQL Server Database Without Any Data Loss - October 2, 2026