Docker Hub

What is Docker Hub?

Docker Hub (hub.docker.com) is the default public registry built into the Docker CLI. When you run docker pull nginx, Docker silently resolves that to docker.io/library/nginx:latest and downloads it from Docker Hub.

It hosts two categories of images:

Official images — curated by Docker, Inc. (e.g., nginx, node, postgres). Short names with no owner prefix.
Verified Publisher images — maintained by software vendors (e.g., elastic/elasticsearch). Displayed with a blue badge.
Community images — published by individuals or teams under a namespace (e.g., mycompany/myapp).

Creating an account and a repository

Sign up at hub.docker.com.
Create a repository: click Create Repository, choose a name, and set visibility to Public or Private.

A Docker Hub image name follows the pattern:

docker.io/<username>/<repository>:<tag>

For example:

docker.io/acme/api-server:2.1.0

When pushing from the CLI you can omit docker.io/ — it is the default registry:

docker push acme/api-server:2.1.0

Public vs private repositories

	Public	Private
Anyone can pull	Yes	No (requires login)
Free tier limit	Unlimited	1 repo on free plan
Use case	Open-source, tutorials	Production workloads

Authenticating with `docker login`

Before you can push, you must authenticate. Docker Hub supports password login, but access tokens are strongly preferred — they are scoped, revocable, and do not expose your password.

Generate a token at Docker Hub → Account Settings → Personal access tokens, then:

docker login
# Enter your Docker Hub username
# Enter your access token (not your password)

Or supply credentials non-interactively (useful in scripts):

echo "$DOCKERHUB_TOKEN" | docker login --username "$DOCKERHUB_USERNAME" --stdin

After login, Docker stores credentials in ~/.docker/config.json. Log out to clear them:

docker logout

Pull rate limits

Docker Hub enforces pull rate limits for unauthenticated requests:

Authentication	Limit
Anonymous (no login)	100 pulls / 6 hours per IP
Free authenticated account	200 pulls / 6 hours
Pro / Team / Business plan	Unlimited

CI runners share public IPs, so anonymous pulls frequently hit the limit. Always authenticate in CI — even with a free account — to get the higher limit.

Official vs verified vs community images

# Official image — no namespace prefix
docker pull postgres:16

# Verified Publisher image
docker pull elastic/elasticsearch:8.14.0

# Community image — always namespace/repo
docker pull bitnami/postgresql:16

When choosing a base image, prefer official or verified publisher images for security and maintenance guarantees.