3.2.1.5 Private Image Repositories

Private image repositories store images that are not publicly accessible, typically containing an organization's proprietary application code, restricted to authenticated and authorized users rather than being available to anyone who knows the repository name.

Why Private Repositories Are Necessary

Most application images contain proprietary source code or configuration that should not be publicly retrievable, which is why organizations run their own private registries, or use private repositories within a hosted registry service, rather than publishing every image publicly.

docker login registry.example.com
docker push registry.example.com/acmecorp/internal-app:1.0

Authentication is required before this push succeeds, since the registry enforces access control on who can write to this private repository.

Pulling From a Private Repository

Retrieving an image from a private repository similarly requires authentication, meaning any host or pipeline that needs to pull it must first be configured with valid credentials.

docker login registry.example.com
docker pull registry.example.com/acmecorp/internal-app:1.0

Authentication in Automated Pipelines

Because CI/CD pipelines need to push and pull from private repositories without a human typing credentials interactively, authentication is typically handled through securely stored credentials or tokens injected into the pipeline environment.

echo "$REGISTRY_TOKEN" | docker login registry.example.com --username ci-bot --password-stdin

Running a Self-Hosted Private Registry

Organizations can run their own private registry entirely under their own infrastructure, rather than relying on a third-party hosted registry, when keeping all image data within their own network is a requirement.

docker run -d -p 5000:5000 --name registry registry:2
docker tag myapp:1.0 localhost:5000/myapp:1.0
docker push localhost:5000/myapp:1.0

Why Private Repositories Matter

Private repositories are essential for any organization building proprietary software with Docker, since they provide the same efficient distribution mechanism public registries offer, while keeping image contents restricted to those explicitly authorized to access them.