What is a container registry, and how does Docker Hub differ from a private registry?
A registry stores and serves images. Docker Hub is the public default with free public repos, while a private registry such as ECR, GCR, ACR, GHCR or a self-hosted one restricts access to your team.
Explain it simply
A registry is a godown of images, like a Play Store for containers. Docker Hub is the big public market where anyone can pick up nginx or python. A private registry is your company's locked store room, where only employees with keys get in.
Images are addressed as registry/namespace/name:tag. If you leave the registry out, Docker assumes docker.io. Cloud providers offer managed registries close to their clusters (AWS ECR, Google Artifact Registry, Azure ACR), GitHub has GHCR, and you can self-host the open source registry image or Harbor. Reasons to go private: proprietary code, access control, vulnerability scanning, faster pulls inside your cloud, and avoiding Docker Hub's pull rate limits for anonymous users.
Example
docker pull nginx # docker.io/library/nginx:latest
docker pull ghcr.io/acme/api:1.4.0 # GitHub registry
docker login 123456789.dkr.ecr.ap-south-1.amazonaws.com
docker pull 123456789.dkr.ecr.ap-south-1.amazonaws.com/api:1.4.0What to say in the interview
"A registry stores and distributes images. Docker Hub is the public default; private registries such as ECR, ACR, GHCR or Harbor add access control, scanning and closeness to the cluster. The full name is registry/namespace/name:tag."
Common mistakes
- Pushing proprietary images to a public Docker Hub repo by mistake.