docker pullDownload an image from a registry
docker pull downloads an image (its manifest and any layers you don't already have) from a registry such as Docker Hub, ECR or GHCR into the local store. Pull by tag for convenience, by digest for an exact, repeatable build.
docker pull [OPTIONS] [REGISTRY/]NAME[:TAG|@DIGEST]You want an image on this host before a deploy, so the container starts instantly instead of downloading first.
docker pullFetch an image from a registry into the local image store without running it.
dockerd expands the reference (nginx becomes docker.io/library/nginx:latest) and speaks the OCI distribution API over HTTPS. The first request gets 401 with a pointer to the registry's token service; dockerd fetches a bearer token, anonymously or with credentials from ~/.docker/config.json or a credential helper. It then GETs /v2/<repo>/manifests/<tag>. For multi-platform images that returns an index, from which it picks the manifest for linux/amd64 (or --platform). The manifest lists a config blob and layer blobs by sha256. Layers already in the local store are skipped; the rest are downloaded in parallel, checked against their digest, decompressed and unpacked into snapshots. Finally the tag is pointed at the new image. The image ID only changes if the content did.
A token, a manifest lookup by tag, a platform choice, and then only the layers you don't already have.
nginx:1.27-alpine becomes docker.io/library/nginx:1.27-alpine: default registry Docker Hub, official images under library/, and :latest if no tag is given.
--platform OS/ARCHPull a specific variant, like linux/arm64 or linux/amd64-a, --all-tagsPull every tag of the repository (rarely what you want)-q, --quietPrint only the final image nameNAME@sha256:DIGESTPull an exact, immutable image instead of a moving tag--disable-content-trustSkip image signature checks (they're off unless DOCKER_CONTENT_TRUST=1)FROM node or image: postgres with no tag in productionThat means :latest, which changes under you; the next deploy may silently get a new major version.
Pin a version tag (postgres:16.4) or a digest (postgres@sha256:...)Assuming docker run always gets the newest imagerun only pulls when the image is missing locally. An old copy of :latest will be used as-is.
docker pull first, or docker run --pull alwaysLetting every CI job pull base images anonymously from Docker HubRate limits are per IP; a busy runner pool behind one NAT address hits them and builds fail randomly.
Log in, or use a registry mirror or ECR pull-through cacheTry these on a Linux machine of your own. Each task has a hint and a solution.
Write the fully qualified form of the image reference 'redis' (registry, repository and tag) that docker pull actually uses, then pull it by that name.
Write the command to pull the arm64 variant of nginx:1.27-alpine onto an x86 build machine.
In the sandbox, compute the sha256 of a file in ~/data the same way a registry checks a layer blob.
In the CrackOps AWS Lab, log in to ECR and pull the shop-api image. Write the two commands.
docker pullDownload an image from a registry
docker pull downloads an image (its manifest and any layers you don't already have) from a registry such as Docker Hub, ECR or GHCR into the local store. Pull by tag for convenience, by digest for an exact, repeatable build.
docker pull [OPTIONS] [REGISTRY/]NAME[:TAG|@DIGEST]You want an image on this host before a deploy, so the container starts instantly instead of downloading first.
docker pullFetch an image from a registry into the local image store without running it.
dockerd expands the reference (nginx becomes docker.io/library/nginx:latest) and speaks the OCI distribution API over HTTPS. The first request gets 401 with a pointer to the registry's token service; dockerd fetches a bearer token, anonymously or with credentials from ~/.docker/config.json or a credential helper. It then GETs /v2/<repo>/manifests/<tag>. For multi-platform images that returns an index, from which it picks the manifest for linux/amd64 (or --platform). The manifest lists a config blob and layer blobs by sha256. Layers already in the local store are skipped; the rest are downloaded in parallel, checked against their digest, decompressed and unpacked into snapshots. Finally the tag is pointed at the new image. The image ID only changes if the content did.
A token, a manifest lookup by tag, a platform choice, and then only the layers you don't already have.
nginx:1.27-alpine becomes docker.io/library/nginx:1.27-alpine: default registry Docker Hub, official images under library/, and :latest if no tag is given.
--platform OS/ARCHPull a specific variant, like linux/arm64 or linux/amd64-a, --all-tagsPull every tag of the repository (rarely what you want)-q, --quietPrint only the final image nameNAME@sha256:DIGESTPull an exact, immutable image instead of a moving tag--disable-content-trustSkip image signature checks (they're off unless DOCKER_CONTENT_TRUST=1)FROM node or image: postgres with no tag in productionThat means :latest, which changes under you; the next deploy may silently get a new major version.
Pin a version tag (postgres:16.4) or a digest (postgres@sha256:...)Assuming docker run always gets the newest imagerun only pulls when the image is missing locally. An old copy of :latest will be used as-is.
docker pull first, or docker run --pull alwaysLetting every CI job pull base images anonymously from Docker HubRate limits are per IP; a busy runner pool behind one NAT address hits them and builds fail randomly.
Log in, or use a registry mirror or ECR pull-through cacheTry these on a Linux machine of your own. Each task has a hint and a solution.
Write the fully qualified form of the image reference 'redis' (registry, repository and tag) that docker pull actually uses, then pull it by that name.
Write the command to pull the arm64 variant of nginx:1.27-alpine onto an x86 build machine.
In the sandbox, compute the sha256 of a file in ~/data the same way a registry checks a layer blob.
In the CrackOps AWS Lab, log in to ECR and pull the shop-api image. Write the two commands.