RegistryAdvanced

Docker Registry Cheatsheet

Run your own OCI-compliant registry with authentication, TLS, and garbage collection.

What it is

The Docker Registry is an open-source, OCI-compliant image storage server. Run it to host private images behind your firewall or as a pull-through cache for Docker Hub.

Installation

Run as a Docker container: docker run -d -p 5000:5000 --name registry registry:2. For production, add TLS and basic auth.

Quick start

docker run -d -p 5000:5000 --name registry registry:2

Start a local registry on port 5000.

docker tag myapp:latest localhost:5000/myapp:latest

Tag an image for the local registry.

docker push localhost:5000/myapp:latest

Push to the local registry.

Common operations

Task	Command	Description
Start registry	`docker run -d -p 5000:5000 registry:2`	Quick local registry (no auth, no TLS).
List repos	`curl http://localhost:5000/v2/_catalog`	All repositories in the registry.
List tags	`curl http://localhost:5000/v2/<repo>/tags/list`	All tags for a specific repo.
Push image	`docker push localhost:5000/<image>:<tag>`	Upload to the local registry.
Pull image	`docker pull localhost:5000/<image>:<tag>`	Download from the local registry.

Real-world examples

Registry with TLS and htpasswd auth

docker run -d -p 443:443 --name registry   -v /certs:/certs   -v /auth:/auth   -v /registry-data:/var/lib/registry   -e REGISTRY_HTTP_ADDR=0.0.0.0:443   -e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/fullchain.pem   -e REGISTRY_HTTP_TLS_KEY=/certs/privkey.pem   -e REGISTRY_AUTH=htpasswd   -e REGISTRY_AUTH_HTPASSWD_REALM="Registry Realm"   -e REGISTRY_AUTH_HTPASSWD_PATH=/auth/htpasswd   registry:2

Best practices

Always use TLS in production — never run a plain HTTP registry on the network.
Enable basic auth or token auth to prevent unauthorized pushes.
Schedule regular garbage collection to free space from deleted images.

Related cheatsheets

Last reviewed: 2026-06-15