Docker Hub

What is Docker Hub?

Docker Hub (hub.docker.com) is the default public registry built into the Docker CLI. When you run docker pull nginx, Docker silently resolves that to docker.io/library/nginx:latest and downloads it from Docker Hub.

It hosts two categories of images:

Official images — curated by Docker, Inc. (e.g., nginx, node, postgres). Short names with no owner prefix.
Verified Publisher images — maintained by software vendors (e.g., elastic/elasticsearch). Displayed with a blue badge.
Community images — published by individuals or teams under a namespace (e.g., mycompany/myapp).

Creating an account and a repository

Sign up at hub.docker.com.
Create a repository: click Create Repository, choose a name, and set visibility to Public or Private.

A Docker Hub image name follows the pattern:

docker.io/<username>/<repository>:<tag>

For example:

docker.io/acme/api-server:2.1.0

When pushing from the CLI you can omit docker.io/ — it is the default registry:

docker push acme/api-server:2.1.0

Public vs private repositories

	Public	Private
Anyone can pull	Yes	No (requires login)
Free tier limit	Unlimited	1 repo on free plan
Use case	Open-source, tutorials	Production workloads

Authenticating with `docker login`

Before you can push, you must authenticate. Docker Hub supports password login, but access tokens are strongly preferred — they are scoped, revocable, and do not expose your password.

Generate a token at Docker Hub → Account Settings → Personal access tokens, then:

docker login
# Enter your Docker Hub username
# Enter your access token (not your password)

Or supply credentials non-interactively (useful in scripts):

echo "$DOCKERHUB_TOKEN" | docker login --username "$DOCKERHUB_USERNAME" --stdin

After login, Docker stores credentials in ~/.docker/config.json. Log out to clear them:

docker logout

Pull rate limits

Docker Hub enforces pull rate limits for unauthenticated requests:

Authentication	Limit
Anonymous (no login)	100 pulls / 6 hours per IP
Free authenticated account	200 pulls / 6 hours
Pro / Team / Business plan	Unlimited

Verified current as of September 2026 against Docker’s own usage documentation (docs.docker.com/docker-hub/usage). CI runners share public IPs, so anonymous pulls frequently hit the limit. Always authenticate in CI — even with a free account — to get the higher limit.

Official vs verified vs community images

# Official image — no namespace prefix
docker pull postgres:18

# Verified Publisher image
docker pull elastic/elasticsearch:8.14.0

# Community image — always namespace/repo
docker pull grafana/grafana:12.3.0

When choosing a base image, prefer official or verified publisher images for security and maintenance guarantees.

Trade-offs

Option	Benefit	Cost
Docker Hub	Free tier is easy to get started with, the largest ecosystem of official images	Anonymous pulls have a rate limit, and fine-grained access control is limited on the free plan
Private registry (e.g. ECR, GHCR)	Ties into a cloud provider’s IAM/permissions in detail, no anonymous pull rate limit	Needs extra setup, and usually locks you into that cloud provider or platform

Common mistakes

Storing a Docker Hub token in a Dockerfile or committing it to source code instead of using a secret store.
Pulling anonymously in CI or production instead of authenticating, and hitting the rate limit at random.
Pushing only the latest tag with no pinned version tag, making it hard to roll back to a previous version.

💡 Real-world example

Docker Hub enforces an anonymous pull rate limit of 100 pulls per 6 hours per IP (docs.docker.com/docker-hub/usage), which pushes many teams — especially those running CI runners or large Kubernetes clusters sharing an IP — to set up a pull-through mirror cache to cut down on requests hitting Docker Hub directly.