Pushing and pulling images

This page describes how to push and pull images, which is two of the most common tasks done with Container Registry. To push a new image to Container Registry, you need to first tag it with the registry name, as described below.

To get up and running with Container Registry, see the quickstart.

For instructions on listing, tagging, and deleting images, see Managing Images.

Before you begin

Make sure that you:

  1. Enabled billing for your project.

  2. Enabled the Container Registry API.

  3. Installed the most recent version of the Cloud SDK, which includes the gcloud command-line tool

  4. Installed Docker. Version 18.03 or newer is required if you want to use the gcloud credential helper for authentication (recommended).

    If you're using a Linux-based operating system, such as Ubuntu or Debian, add your username to the docker group so that you can run Docker without using sudo:

    sudo usermod -a -G docker ${USER}

    Log out and log back in for group membership changes to take effect. If you are using a virtual machine, you may need to restart the virtual machine for membership changes to take effect.

  5. Have permissions to push and pull from the registry

  6. Configured Docker to use gcloud as a credential helper, or are using another authentication method. To use gcloud as the credential helper, run the command:

    gcloud auth configure-docker

  7. Docker requires credential helpers to be in the system PATH. Ensure that your chosen credential helper, gcloud or docker-credential-gcr, is in the system PATH

Pushing an image to a registry

To push any local image to Container Registry, you need to first tag it with the registry name and then push the image.

Tag the local image with the registry name

  1. Determine the registry name:

    1. Choose a hostname, which specifies location where you will store the image.

      • gcr.io hosts images in data centers in the United States, but the location may change in the future
      • us.gcr.io hosts image in data centers in the United States, in a separate storage bucket from images hosted by gcr.io
      • eu.gcr.io hosts the images in the European Union
      • asia.gcr.io hosts images in data centers in Asia

      These locations correspond to the multi-regions for Cloud Storage storage buckets. When you push an image to a registry with a new hostname, Container Registry creates a storage bucket in the specified multi-region. This bucket is the underlying storage for the registry. Within a project, all registries with the same hostname share one storage bucket.

      In the console, the images' hostname will be listed under Location.

    2. Choose an image name, which can be different from the image's name on your local machine.

    3. Combine the hostname, your Google Cloud Console project ID, and image name:

      [HOSTNAME]/[PROJECT-ID]/[IMAGE]

      If your project ID contains a colon (:), see Domain-scoped projects.

  2. Tag the local image with the registry name by using the command:

    docker tag [SOURCE_IMAGE] [HOSTNAME]/[PROJECT-ID]/[IMAGE]

    where [SOURCE_IMAGE] is the local image name or image ID.

    This command names the image with the registry name and applies the tag latest. If you want to apply a different tag, then use the command:

    docker tag [SOURCE_IMAGE] [HOSTNAME]/[PROJECT-ID]/[IMAGE]:[TAG]

Push the tagged image to Container Registry

The Docker credential helper is the simplest way to configure Docker to authenticate directly with Container Registry. You then use the docker command to tag, push, and pull images. Alternatively, you can use the client libraries to manage container images, or you can interact directly with the Docker API.

Push the tagged image to Container Registry by using the command:

docker push [HOSTNAME]/[PROJECT-ID]/[IMAGE]

This command pushes the image that has the tag latest. If you want to push an image that has a different tag, use the command:

docker push [HOSTNAME]/[PROJECT-ID]/[IMAGE]:[TAG]

When you push an image to a registry with a new hostname, Container Registry creates a storage bucket in the specified multi-regional location. After pushing your image, you can:

  • Go to the Cloud Console to view the registry and image.

  • Run gcloud container images list-tags to view the image's tag(s) and automatically-generated digest:

    gcloud container images list-tags [HOSTNAME]/[PROJECT-ID]/[IMAGE]

    The command's output is similar to the following:

    DIGEST        TAGS        TIMESTAMP
44bde...      test        2017-..-..

Pulling images from a registry

To pull from Container Registry, use the command:

docker pull [HOSTNAME]/[PROJECT-ID]/[IMAGE]:[TAG]

or

docker pull [HOSTNAME]/[PROJECT-ID]/[IMAGE]@[IMAGE_DIGEST]

where:

  • [HOSTNAME] is listed under Location in the console. It's one of four options: gcr.io, us.gcr.io, eu.gcr.io, or asia.gcr.io.
  • [PROJECT-ID] is your Google Cloud Console project ID. If your project ID contains a colon (:), see Domain-scoped projects.
  • [IMAGE] is the image's name in Container Registry.
  • [TAG] is the tag applied to the image. In a registry, tags are unique to an image.
  • [IMAGE_DIGEST] is the sha256 hash value of the image contents. In the console, click on the specific image to see its metadata. The digest is listed as the Image digest.

To get the pull command for a specific image:

  1. Click on the name of an image to go to the specific registry.

  2. In the registry, check the box next to the version of the image that you want to pull.

  3. Click SHOW PULL COMMAND on the top of the page.

  4. Copy the pull command, which identifies the image using either the tag or the digest.

What's next