Registries & Tagging — Push Once, Pull Anywhere

~14 min · production, registry

Level 0Container Curious

0 XP0/36 lessons0/10 achievements

0/120 XP to next level120 XP to go0% complete

Where do images live?

A registry is to images what GitHub is to code. The default is Docker Hub. But you'll meet many: GHCR (GitHub), ECR (AWS), Artifact Registry (GCP), ACR (Azure), Harbor (self-hosted).

Tag like you mean it

Always tag with both a semantic version and a Git SHA. Semver is for humans; SHA is for traceability.

Code

Tag and push to GHCR·bash

# Build with a meaningful tag
docker build -t ghcr.io/cwk/myapp:1.2.3 -t ghcr.io/cwk/myapp:$(git rev-parse --short HEAD) .

# Login (token, not password)
echo $GHCR_TOKEN | docker login ghcr.io -u USERNAME --password-stdin

# Push both tags
docker push ghcr.io/cwk/myapp:1.2.3
docker push ghcr.io/cwk/myapp:$(git rev-parse --short HEAD)

Tagging strategies summary·text

# Recommended: combine semver + git SHA
myapp:1.2.3            # human-friendly version
myapp:1.2              # rolling minor
myapp:1                # rolling major
myapp:abc1234          # exact commit
myapp:2026-05-03       # date-based (audit-friendly)

# Avoid: only :latest in production

External links

GitHub Container Registry

Exercise

Pick a registry of your choice (GHCR, Docker Hub, ECR). Build a small image, tag it with both 1.0.0 and the current git SHA, push both. Pull both from a different machine (or docker rmi locally first to force a real pull). Capture the commands.

Progress

Progress is local-only — sign in to sync across devices.

← 🔍 Debugging Containers — Read the Exit CodeNetwork Debugging — netshoot, dig, curl, nslookup Next →Managed Container Services — Kubernetes Is Often Overkill

Spotted a bug or have feedback on this page?Report an Issue

Comments 0

🔔 Reply notifications (sign in)

No comments yet — be the first.