All Products
Document Center

Image basic operations

Last Updated: Jan 08, 2019

This article focuses on three of the most popular Docker commands: logon, pull, and push.

Note: See Glossary for the basic terms of Container Registry.

Docker logon

Take Alibaba Cloud Hangzhou public network Registry as an example.

You must specify the domain name of the Registry and enter your username and password to log on.

Note: Here the logon password is set in the Container Registry console, which is not your Alibaba Cloud logon password.modify

  1. docker@default-online:~$ docker login
  2. Username:
  3. Password:
  4. Login Succeeded

After the successful logon, Login Succeeded is displayed.

You can also view the config.json file to confirm your logon information.

  1. docker@default-online:~$ cat ~/.docker/config.json
  2. {
  3. "auths": {
  4. "": {
  6. }
  7. }
  8. }

How do I log on with a sub-account?

  1. Log on to the Container Registry console with your sub-account and set your Registry logon password.

  2. Log on with the username [sub-account name]@[enterprise alias].

    You can set and view the enterprise alias of the primary account in the Resource Access Management (RAM) console. If no enterprise alias is available, the UID of the primary account is used by default.

For example:

The sub-account name is subaccount and the enterprise alias is misaka-network.

  1. docker@default-online:~$ docker login
  2. Username: subaccount@misaka-network
  3. Password:
  4. Login Succeeded

Docker pull


  • You can pull the images from a public repository without logging on to the Registry.
  • The logged on Registry must be the one on which you manage images. For example, if you only log on to the and push the images of, the client reports unauthorized access.

Take the public image of Container Service as an example.

  1. docker@default-online:~$ docker pull
  2. 0.8: Pulling from acs/agent
  3. 5a026b6c4964: Already exists
  4. e4b621e8d9cb: Already exists
  5. 8bc2fd04bdd4: Pull complete
  6. a977b0087b3e: Pull complete
  7. 8f6e00ea13c6: Pull complete
  8. 875dd8c9666f: Pull complete
  9. 9c07bcabc35d: Pull complete
  10. Digest: sha256:cac848bd31bccf2a041bda7b57e3051341093abde6859df9ee9d332dfec6ddd9
  11. Status: Downloaded newer image for

You can view the downloaded image by using the following command (note the repository coordinate and tag).

  1. docker@default-online:~$ docker images
  3. 0.8 b9ba5841bdb0 24 hours ago 42.18 MB

Docker push

After an image is built or packaged locally, you can push it to a Registry.

The preparation of pushing an image is almost the same as that of pulling an image.

Make sure that you have read and write permissions to the repository or are authorized to read from and write to the repository. Otherwise, an error is reported as follows:

  1. docker@default-online:~$ docker push
  2. The push refers to a repository []
  3. 359f80267111: Layer already exists
  4. 7e5fa28d90b8: Layer already exists
  5. b20d7f600f63: Layer already exists
  6. 4a159b4f8370: Layer already exists
  7. 7c3712ebe877: Layer already exists
  8. d91d130a53aa: Layer already exists
  9. fcad8ad5a40f: Layer already exists
  10. unauthorized: authentication required


Docker logon failure

Mainly troubleshoot the following two issues:

  • The logon password of Alibaba Cloud account is used, instead of the independent logon password of Registry. The Registry logon password is set and modified in the Container Registry console.


  • If you use sudo for logon, make sure you first enter the Linux user password, instead of the Registry logon password.

    The Linux user password usually allows you to try at most three times and prompts try again when the password is wrong. However, the Docker client exits after you enter the wrong Registry logon password once and returns the following error:

    1. Error response from daemon: Get unauthorized: authentication required

Docker pull failure

The system prompts Error: image xxx not found.

Troubleshoot the issue as follows:

  • If you want to download images from a public repository, the error is caused due to the incorrect image URL. Search for this public repository in the Container Registry console and check if the image version to be downloaded exists.

  • If you want to download images from a private repository, check your Registry logon status first. Run the following command to view all the domain names of the logged on Registries.

    1. cat ~/.docker/config.json

    Check if the domain name of the Registry that you want to download images is in the list. If not, log on to the relevant Registry.

    If the Registry is already logged on, check if your logon account has permissions to download the image. Sub-accounts do not have any permission by default.

The system prompts Error: filesystem layer verification failed for digest.

This error indicates the downloaded block files failed the verification, which occurs in rare cases. Generally, you can fix it by trying again.

Docker push failure

The system prompts denied: requested access to the resource is denied.

The troubleshooting steps are roughly the same as those for Docker pull failure. The only difference is that a higher authorization level is required in this case.