Docker Hub

Docker Hub — 镜像仓库管理

Guidance for publishing, pulling, and managing Docker images.

When to Use

ALWAYS use this skill when the user mentions:

• "docker hub", "docker registry", "镜像仓库"
• "docker push", "docker pull", "docker tag"
• "私有仓库", "private registry", "Harbor"
• "镜像加速", "registry mirror"
• "docker login", "authentication"

Core Workflow

# Login
docker login
docker login registry.example.com   # Private registry

# Tag
docker tag myapp:latest myuser/myapp:v1.0.0
docker tag myapp:latest myuser/myapp:latest

# Push
docker push myuser/myapp:v1.0.0
docker push myuser/myapp:latest

# Pull
docker pull myuser/myapp:v1.0.0
docker pull myuser/myapp:latest

Tag Strategy

Production: NEVER use :latest. Always pin exact version or digest.
Development: :latest is OK for convenience.

Private Registry

Docker Registry (Official)

docker run -d -p 5000:5000 --name registry \
  -v registry:/var/lib/registry \
  registry:2
docker tag myapp localhost:5000/myapp:v1
docker push localhost:5000/myapp:v1

Harbor (Enterprise)

# Download and run
wget https://github.com/goharbor/harbor/releases/download/v2.10.0/harbor-offline-installer-v2.10.0.tgz
tar xzf harbor-offline-installer-v2.10.0.tgz
cd harbor
cp harbor.yml.tmpl harbor.yml
# Edit harbor.yml (hostname, passwords)
./install.sh

Image Digest (Immutable Reference)

# Get digest
docker inspect --format='{{.RepoDigests}}' myimage:tag

# Pull by digest (immutable)
docker pull alpine@sha256:abc123...

Workflow — 推荐操作流程

Step 1: 登录仓库: docker login 或 docker login ghcr.io Step 2: 打标签: docker tag myapp:v1 ghcr.io/org/myapp:v1 Step 3: 推送镜像: docker push ghcr.io/org/myapp:v1 Step 4: 验证: docker pull ghcr.io/org/myapp:v1 拉取确认 Step 5: 固定版本: 生产使用 docker pull myapp@sha256:abc...

Gotchas — Common Pitfalls

• :latest in production: Tags are mutable — latest can point to different images over time. → Recovery: Always pin version or digest: docker pull myapp:v1.2.3@sha256:abc....
• Mixed public/private registries: docker login is per-registry. → Recovery: docker login registry.example.com separately; use credential helpers: docker-credential-ecr-login for AWS ECR.
• Large image push timeout: Set max-concurrent-uploads in daemon config for large images. → Recovery: Edit /etc/docker/daemon.json: {"max-concurrent-uploads": 1} for slow connections.
• Registry auth in CI: Use docker/login-action (GitHub Actions) or secrets manager. → Recovery: Never commit credentials; use OIDC for cloud registries instead of long-lived tokens.

Boundary — 能力边界（适用与不适用场景）

When NOT to Use

Security & Stability

• Never commit registry credentials. Use CI secrets manager.
• Use content trust: export DOCKER_CONTENT_TRUST=1 for signed images.
• Harbor provides vulnerability scanning, replication, and RBAC.
• No executable scripts bundled. Guidance only.

📚 官方文档参考

🧭 Docker Skills Journey

📍 You are here: docker-hub — 镜像仓库管理

← Prev: docker-scout — Vulnerability scanning → Next: docker-cicd — CI/CD integration

FAQ

Q1: 如何快速上手此技能？ A: 参考上方的快速开始章节，按步骤操作即可。

Q2: 遇到版本不兼容问题怎么办？ A: 检查依赖版本，使用 lock 文件锁定，参考常见陷阱章节。

Q3: 如何在生产环境使用？ A: 参考最佳实践章节，确保配置正确，做好监控和日志。

Q4: 性能如何优化？ A: 参考性能优化相关文档，使用缓存、索引等手段。

Q5: 如何贡献或反馈问题？ A: 在 GitHub 仓库提交 Issue 或 Pull Request。

Q6: 是否支持中文？ A: 支持中文文档和中文注释，详见国内适配章节。