This topic describes the three most common operations on Docker images, namely, docker login, docker pull, and docker push. It also describes how to log on to a registry as a Resource Access Management (RAM) user. You can better use Container Registry after getting familiar with basic operations on Docker images.

Background

Before using Container Registry, you must install Docker. For more information about how to install Docker, see:

docker login

The following section describes how to use the docker login command to log on to a registry in China (Hangzhou) on Alibaba Cloud over the public network:

  1. Specify the domain name of the registry and enter your logon username and password.

    After successful logon, Login Succeeded appears.

    docker@default-online:~$ docker login registry.cn-hangzhou.aliyuncs.com
    Username: sample@alibaba-inc.com
    Password:
    Login Succeeded
    Note The logon password is the fixed password you set in the Container Registry console, but not the password for logging on to Alibaba Cloud.Set a fixed password
  2. View the config.json file to confirm your logon information.
    docker@default-online:~$ cat ~/.docker/config.json
    {
        "auths": {
            "registry.cn-hangzhou.aliyuncs.com": {
                "auth": "XXXXXXXXXXXXXXXXXXXXXX"
            }
        }
    }        

docker pull

The following example describes how to use the docker pull command to pull the public image registry.cn-hangzhou.aliyuncs.com/acs/agent:0.8 of Container Service:

docker@default-online:~$ docker pull registry.cn-hangzhou.aliyuncs.com/acs/agent:0.8
0.8: Pulling from acs/agent
5a026b6c4964: Already exists
e4b621e8d9cb: Already exists
8bc2fd04bdd4: Pull complete
a977b0087b3e: Pull complete
8f6e00ea13c6: Pull complete
875dd8c9666f: Pull complete
9c07bcabc35d: Pull complete
Digest: sha256:cac848bd31bccf2a041bda7b57e3051341093abde6859df9ee9d332dfec6ddd9
Status: Downloaded newer image for registry.cn-hangzhou.aliyuncs.com/acs/agent:0.8            
Note
  • If you want to pull images from the Docker official website, see Accelerate the download of official images.
  • If you want to pull images from a public repository, the pull operation is allowed without the need to log on to the registry.
  • You can only pull images from a registry you have logged on to. For example, if you have logged on to registry.cn-hangzhou.aliyuncs.com, an error message indicating unauthorized access appears on the client if you pull images from registry.cn-beijing.aliyuncs.com.

You can run the following command to view the pulled images. Check the repository location and image tags in the command output.

docker@default-online:~$ docker images
REPOSITORY                                    TAG                 IMAGE ID            CREATED             SIZE
registry.cn-hangzhou.aliyuncs.com/acs/agent   0.8                 b9ba5841bdb0        24 hours ago        42.18 MB            

docker push

After images are built or packaged locally, you can run the docker push command to push them to the registry.

The preparation for pushing images is basically the same as that for pulling images. Make sure that you have the read/write permissions on the repository. Otherwise, the error message "unauthorized: authentication required" appears.

docker@default-online:~$ docker push registry.cn-hangzhou.aliyuncs.com/acs/agent:0.8
The push refers to a repository [registry.cn-hangzhou.aliyuncs.com/acs/agent]
359f80267111: Layer already exists
7e5fa28d90b8: Layer already exists
b20d7f600f63: Layer already exists
4a159b4f8370: Layer already exists
7c3712ebe877: Layer already exists
d91d130a53aa: Layer already exists
fcad8ad5a40f: Layer already exists
unauthorized: authentication required            

Log on to a registry as a RAM user

  1. Log on to the Container Registry console as a RAM user and set a fixed password for logging on to the registry.
  2. Use [RAM user]@[Enterprise alias] as the logon username.

    You can set and view the enterprise alias of your Alibaba Cloud account in the RAM console. If you do not have an enterprise alias, the UID of your Alibaba Cloud account is used by default.

    Assume that the RAM user is subaccount and the enterprise alias is misaka-network. The logon username is subaccount@misaka-network.

    docker@default-online:~$ docker login registry.cn-hangzhou.aliyuncs.com
    Username: subaccount@misaka-network
    Password:
    Login Succeeded