Pulling Images — Tags, Variants, Digests

~12 min · commands, registry

Level 0Container Curious

0 XP0/36 lessons0/10 achievements

0/120 XP to next level120 XP to go0% complete

Where images come from

docker pull downloads an image from a registry to your local image cache. Default registry is Docker Hub (docker.io). You can use any OCI registry: GHCR, ECR, GCR, ACR, self-hosted Harbor.

Tag patterns that matter

nginx → expands to docker.io/library/nginx:latest. Implicit. Mutable. Production poison.
nginx:1.27-alpine → version + variant. Reproducible across team. The right default.
nginx@sha256:abc123... → pinned by digest. Byte-identical. Only choice for reproducible CI/CD.

The :latest trap

:latest is just a tag name. It is whatever the publisher last pushed to that tag. It can change overnight. Two engineers on the same team using :latest can be running different code. Never use it in production. Avoid it in development too.

Code

Pull patterns·bash

# Implicit (don't do this in real work)
docker pull nginx

# Pinned version + variant — the daily-use form
docker pull nginx:1.27-alpine
docker pull python:3.12-slim
docker pull postgres:16

# Pinned by digest — for CI, supply chain, regulatory contexts
docker pull nginx@sha256:9d1c5a3c2c8f...   # immutable forever

# Pull from a non-Hub registry
docker pull ghcr.io/cwk/myapp:v1.2.3
docker pull 123456.dkr.ecr.us-east-1.amazonaws.com/myapp:1.0

External links

Exercise

Pull python:3.12-slim once, note the digest in docker images --digests. Pull it again a week later. Is the digest the same? If not, what does that tell you about reproducibility — and how would you pin it for CI?

Progress

Progress is local-only — sign in to sync across devices.

← 📦 Why Containers? FoundationsThe Ecosystem — Engine, Desktop, Alternatives, When Not to Use Next →docker run — The Flag Vocabulary

Spotted a bug or have feedback on this page?Report an Issue

Comments 0

🔔 Reply notifications (sign in)

No comments yet — be the first.