This topic describes the three most common operations on Docker images, namely, docker login, docker pull, and docker push. It also describes how to log on to a registry as a RAM user. You can better use Container Registry after you get familiar with basic operations on Docker images.

Background information

Before you use Container Registry, you must install Docker. For more information about how to install Docker, see:

docker login

This section describes how to use the docker login command to log on to a registry in the China (Hangzhou) region on Alibaba Cloud over the Internet:

  1. Specify the domain name of the registry and enter your logon username and password.

    After successful logon, Login Succeeded appears.

    docker@default-online:~$ docker login
    Login Succeeded
    Note The logon password is the fixed password you set in the Container Registry console, but not the password used to log on to Alibaba Cloud.Set a fixed password
  2. View the config.json file to confirm your logon information.
    docker@default-online:~$ cat ~/.docker/config.json
        "auths": {
            "": {
                "auth": "XXXXXXXXXXXXXXXXXXXXXX"

docker pull

The following example describes how to use the docker pull command to pull the public image of Container Service:

docker@default-online:~$ docker pull
0.8: Pulling from acs/agent
5a026b6c4964: Already exists
e4b621e8d9cb: Already exists
8bc2fd04bdd4: Pull complete
a977b0087b3e: Pull complete
8f6e00ea13c6: Pull complete
875dd8c9666f: Pull complete
9c07bcabc35d: Pull complete
Digest: sha256:cac848bd31bccf2a041bda7b57e3051341093abde6859df9ee9d332dfec6ddd9
Status: Downloaded newer image for            
  • If you want to pull images from the Docker official website, see Accelerate the download of official images.
  • If you want to pull images from a public repository, the pull operation is allowed without the need to log on to the registry.
  • You can pull images only from a registry to which you have logged on. Assume that you have logged on to If you pull images from, an error message indicating unauthorized access appears on the client.

You can run the docker images command to view the pulled images. Check the repository location and image tags in the command output.

docker@default-online:~$ docker images
REPOSITORY                                    TAG                 IMAGE ID            CREATED             SIZE   0.8                 b9ba5841bdb0        24 hours ago        42.18 MB            

docker push

After on-premises images are built or packaged, you can push them to the registry.

The preparation for pushing images is basically the same as that for pulling images. Make sure that you have the read and write permissions on the repository. Otherwise, the error message "unauthorized: authentication required" appears.

docker@default-online:~$ docker push
The push refers to a repository []
359f80267111: Layer already exists
7e5fa28d90b8: Layer already exists
b20d7f600f63: Layer already exists
4a159b4f8370: Layer already exists
7c3712ebe877: Layer already exists
d91d130a53aa: Layer already exists
fcad8ad5a40f: Layer already exists
unauthorized: authentication required            

Log on to a registry as a RAM user

  1. Log on to the Container Registry console as a RAM user and set a fixed password used to log on to the registry.
  2. Use [RAM user]@[Enterprise alias] as the logon username.

    You can set and view the enterprise alias of your Alibaba Cloud account in the RAM console. If you do not have an enterprise alias, the UID of your Alibaba Cloud account is used by default.

    Assume that the RAM user is subaccount and the enterprise alias is misaka-network. The logon username is subaccount@misaka-network.

    docker@default-online:~$ docker login
    Username: subaccount@misaka-network
    Login Succeeded