Docker Docker Hub
Where the images you docker pull come from, and how to judge whether one is trustworthy.
Registry and naming
Docker Hub is Docker’s cloud image registry (a central store of images, much like npm is for Node packages). Each image lives in a repository, and tags within a repo distinguish versions. Full naming format:
[registry]/[user or org]/[repo]:[tag]
python:3.12-slim # Docker Official Image (registry and library prefix omitted)
someuser/myapp:v1.0 # personal / org repo
myregistry.local:5000/test:1.0 # self-hosted registry
:tag equals :latest; avoid latest in Dockerfiles and production (see Choosing images).
Three trust tiers
Not every image is trustworthy. Look at three tiers:
| Tier | How to spot it | Maintainer |
|---|
| Docker Official Images | No user prefix (python, ubuntu, postgres), official badge | Curated by Docker, follows Dockerfile best practices, near-zero CVEs |
| Verified Publisher | ”Verified Publisher” badge, vendor name in the path | Commercial vendor reviewed by Docker |
| Community images | Format username/image, no badge | Individual users; judge by download count and reputation |
Public vs private
| Public | Private |
|---|
| Visibility | Anyone can pull, no login | Only authorized accounts |
| Free plan | Unlimited public repos | 1 private repo (free personal plan) |
Login, push, pull
docker pull python:3.12-slim # pull an official image
docker pull someuser/myapp:v1.0 # pull a user repo
docker login # log in (device code flow, browser confirm)
echo "$DOCKER_PASSWORD" | docker login -u "$DOCKER_USERNAME" --password-stdin # CI, keeps password out of shell history
docker tag myapp:latest user/myapp:v1.0 # tag into the right format before push
docker push user/myapp:v1.0 # push to your own repo
~/.docker/config.json.
Pull rate limits (as of 2026-06)
| Account type | Pull limit | Window |
|---|
| Anonymous (not logged in) | 100 per IPv4 or IPv6 /64 subnet | Per 6 hours |
| Authenticated free account | 200 | Per 6 hours |
| Paid plans (Pro / Team / Business) | Unlimited | — |
Exceeding the limit returns HTTP 429 (Too Many Requests). CI is the most likely to hit it; standard fixes: docker login then pull (raises you from 100 to 200), upgrade to a paid plan, or run a local pull-through cache (the official registry image in proxy mode).
Next
Reference: docs.docker.com/docker-hub/usage
