This page describes how to push and pull images, which is two of the most common tasks done with Container Registry. To push a new image to Container Registry, you need to first tag it with the registry name, as described below.
To get up and running with Container Registry, see the quickstart.
For instructions on listing, tagging, and deleting images, see Managing Images.
Before you begin
Make sure that you:
Installed the most recent version of the Cloud SDK, which includes the
gcloud
command-line toolEnabled billing for your project.
Installed Docker. Version 18.03 or newer is required if you want to use the
gcloud
credential helper for authentication (recommended).If you're using a Linux-based operating system, such as Ubuntu or Debian, add your username to the
docker
group so that you can run Docker without usingsudo
:sudo usermod -a -G docker ${USER}
Log out and log back in for group membership changes to take effect. If you are using a virtual machine, you may need to restart the virtual machine for membership changes to take effect.
Have permissions to push and pull from the registry
Configured Docker to use
gcloud
as a credential helper, or are using another authentication method. To usegcloud
as the credential helper, run the command:gcloud auth configure-docker
Docker requires credential helpers to be in the system
PATH
. Ensure that your chosen credential helper,gcloud
ordocker-credential-gcr
, is in the systemPATH
Pushing an image to a registry
To push any local image to Container Registry, you need to first tag it with the registry name and then push the image.
Tag the local image with the registry name
Determine the registry name:
Choose a hostname, which specifies the region of the registry's storage. This region is not your location, but the location where the images will be stored. For example, if you are in Australia, you may want to use the host in Asia.
The four options are:
gcr.io
hosts images in data centers in the United States, but the location may change in the futureus.gcr.io
hosts image in data centers in the United States, in a separate storage bucket from images hosted bygcr.io
eu.gcr.io
hosts images in data centers in the European Unionasia.gcr.io
hosts images in data centers in Asia
In the console, the images' hostname will be listed under Location.
Choose an image name, which can be different from the image's name on your local machine.
Combine the hostname, your Google Cloud Console project ID, and image name:
[HOSTNAME]/[PROJECT-ID]/[IMAGE]
If your project ID contains a colon (
:
), see Domain-scoped projects.
Tag the local image with the registry name by using the command:
docker tag [SOURCE_IMAGE] [HOSTNAME]/[PROJECT-ID]/[IMAGE]
where
[SOURCE_IMAGE]
is the local image name or image ID.This command names the image with the registry name and applies the tag
latest
. If you want to apply a different tag, then use the command:docker tag [SOURCE_IMAGE] [HOSTNAME]/[PROJECT-ID]/[IMAGE]:[TAG]
Push the tagged image to Container Registry
The Docker credential helper is the simplest way to
configure Docker to authenticate directly with Container Registry. You then
use the docker
command to tag, push, and pull images. Alternatively, you can
use the client libraries
to manage container images, or you can interact directly with the Docker API.
Push the tagged image to Container Registry by using the command:
docker push [HOSTNAME]/[PROJECT-ID]/[IMAGE]
This command pushes the image that has the tag latest
. If you want to
push an image that has a different tag, use the command:
docker push [HOSTNAME]/[PROJECT-ID]/[IMAGE]:[TAG]
When you push an image to a registry with a new hostname, Container Registry creates a storage bucket in the specified multi-regional location. After pushing your image, you can:
Go to the Cloud Console to view the registry and image.
Run
gcloud container images list-tags
to view the image's tag(s) and automatically-generated digest:gcloud container images list-tags [HOSTNAME]/[PROJECT-ID]/[IMAGE]
The command's output is similar to the following:
DIGEST TAGS TIMESTAMP 44bde... test 2017-..-..
Pulling images from a registry
To pull from Container Registry, use the command:
docker pull [HOSTNAME]/[PROJECT-ID]/[IMAGE]:[TAG]
or
docker pull [HOSTNAME]/[PROJECT-ID]/[IMAGE]@[IMAGE_DIGEST]
where:
[HOSTNAME]
is listed under Location in the console. It's one of four options:gcr.io
,us.gcr.io
,eu.gcr.io
, orasia.gcr.io
.[PROJECT-ID]
is your Google Cloud Console project ID. If your project ID contains a colon (:
), see Domain-scoped projects.[IMAGE]
is the image's name in Container Registry.[TAG]
is the tag applied to the image. In a registry, tags are unique to an image.[IMAGE_DIGEST]
is the sha256 hash value of the image contents. In the console, click on the specific image to see its metadata. The digest is listed as the Image digest.
To get the pull command for a specific image:
Click on the name of an image to go to the specific registry.
In the registry, check the box next to the version of the image that you want to pull.
Click SHOW PULL COMMAND on the top of the page.
Copy the pull command, which identifies the image using either the tag or the digest.
What's next
- Learn about managing your images, including adding or removing tags and deleting images.
- Learn about configuring access control.
- Read more about Container Registry's components and features.
- If you want to run containers on Compute Engine, learn about containers on Compute Engine.