Docker Cheatsheet

Registry

Use this Docker reference while you build software engineering projects, review code for technical interview prep, or polish examples for a software engineer resume.

Logging In and Out

docker login                            # Docker Hub (prompts for credentials)
docker login -u myuser docker.io        # explicit registry
docker login ghcr.io                    # GitHub Container Registry
docker login registry.example.com       # private registry

docker logout docker.io

Credentials are stored in ~/.docker/config.json. Use a credential helper (docker-credential-pass, docker-credential-osxkeychain) in production — never plaintext credentials in config files.

Tagging for a Registry

# Pattern: registry/namespace/image:tag
docker tag myapp:1.0 docker.io/myuser/myapp:1.0
docker tag myapp:1.0 ghcr.io/myorg/myapp:1.0
docker tag myapp:1.0 123456789.dkr.ecr.us-east-1.amazonaws.com/myapp:1.0
docker tag myapp:1.0 registry.example.com:5000/myapp:1.0

Pushing and Pulling

docker push myuser/myapp:1.0
docker push myuser/myapp:latest
docker push --all-tags myuser/myapp     # push all local tags for this image

docker pull myuser/myapp:1.0
docker pull --platform linux/arm64 myuser/myapp:1.0

Docker Hub

docker search nginx --limit 10 --filter is-official=true
docker search nginx --format "{{.Name}}\t{{.StarCount}}"

# Automated builds are configured on hub.docker.com — not via CLI

GitHub Container Registry (GHCR)

# Authenticate with a PAT (packages:read/write scope)
echo $GHCR_TOKEN | docker login ghcr.io -u USERNAME --password-stdin

docker pull ghcr.io/org/repo:latest
docker push ghcr.io/org/repo:1.0

Amazon ECR

# Log in (token valid 12 h)
aws ecr get-login-password --region us-east-1 \
  | docker login --username AWS --password-stdin \
    123456789.dkr.ecr.us-east-1.amazonaws.com

# Create repo (one-time)
aws ecr create-repository --repository-name myapp --region us-east-1

docker tag myapp:1.0 123456789.dkr.ecr.us-east-1.amazonaws.com/myapp:1.0
docker push 123456789.dkr.ecr.us-east-1.amazonaws.com/myapp:1.0

Google Artifact Registry / GCR

gcloud auth configure-docker us-central1-docker.pkg.dev

docker tag myapp:1.0 us-central1-docker.pkg.dev/myproject/myrepo/myapp:1.0
docker push us-central1-docker.pkg.dev/myproject/myrepo/myapp:1.0

Running a Private Registry

# Simple local registry on port 5000
docker run -d -p 5000:5000 --restart always --name registry \
  -v registry_data:/var/lib/registry \
  registry:2

docker tag myapp:1.0 localhost:5000/myapp:1.0
docker push localhost:5000/myapp:1.0
docker pull localhost:5000/myapp:1.0

# List all images in local registry
curl http://localhost:5000/v2/_catalog
curl http://localhost:5000/v2/myapp/tags/list

Multi-platform Push (buildx)

docker buildx build \
  --platform linux/amd64,linux/arm64 \
  -t myuser/myapp:1.0 \
  --push .                         # builds AND pushes in one step

Image Scanning

docker scout cves myapp:1.0        # Docker Scout (built-in, requires login)
docker scout recommendations myapp:1.0

# Third-party
trivy image myapp:1.0
grype myapp:1.0
snyk container test myapp:1.0

Digest Pinning

# Pull by digest (immutable, not just a tag)
docker pull nginx@sha256:a484819eb60211f5299034ac80f6a681b06f89e65866ce91f356ed7c72af059c

# Get an image's digest
docker inspect --format='{{index .RepoDigests 0}}' nginx:latest

Pin production images by digest, not tag, to prevent silent updates breaking your deployment.

CI/CD Pattern (GitHub Actions)

- name: Log in to GHCR
  uses: docker/login-action@v3
  with:
    registry: ghcr.io
    username: ${{ github.actor }}
    password: ${{ secrets.GITHUB_TOKEN }}

- name: Build and push
  uses: docker/build-push-action@v6
  with:
    push: true
    tags: ghcr.io/${{ github.repository }}:${{ github.sha }}
    platforms: linux/amd64,linux/arm64
    cache-from: type=gha
    cache-to: type=gha,mode=max