Pushing and pulling images

This page describes how to push and pull images, which is two of the most common tasks done with Container Registry. To push a new image to Container Registry, you need to first tag it with the registry name, as described below.

To get up and running with Container Registry, see the quickstart.

For instructions on listing, tagging, and deleting images, see Managing Images.

Before you begin

Make sure that you:

1. Installed the most recent version of the Cloud SDK, which includes the gcloud command-line tool

2. Enabled billing for your project.

3. Installed Docker. Version 18.03 or newer is required if you want to use the gcloud credential helper for authentication (recommended).

   If you're using a Linux-based operating system, such as Ubuntu or Debian, add your username to the docker group so that you can run Docker without using sudo:

   sudo usermod -a -G docker ${USER}

   Log out and log back in for group membership changes to take effect. If you are using a virtual machine, you may need to restart the virtual machine for membership changes to take effect.

   Caution: The docker group is equivalent to the root user. See the Docker documentation for details on how this affects the security of your system.

4. Have permissions to push and pull from the registry

5. Configured Docker to use gcloud as a credential helper, or are using another authentication method. To use gcloud as the credential helper, run the command:

   gcloud auth configure-docker
   

6. Docker requires credential helpers to be in the system PATH. Ensure that your chosen credential helper, gcloud or docker-credential-gcr, is in the system PATH

Pushing an image to a registry

To push any local image to Container Registry, you need to first tag it with the registry name and then push the image.

Tag the local image with the registry name

Note: You must be authenticated to Container Registry before tagging an image to successfully push the image to the registry.

1. Determine the registry name:

   1. Choose a hostname, which specifies the region of the registry's storage. This region is not your location, but the location where the images will be stored. For example, if you are in Australia, you may want to use the host in Asia.

      The four options are:

      • gcr.io hosts images in data centers in the United States, but the location may change in the future
      • us.gcr.io hosts image in data centers in the United States, in a separate storage bucket from images hosted by gcr.io
      • eu.gcr.io hosts images in data centers in the European Union
      • asia.gcr.io hosts images in data centers in Asia

      In the console, the images' hostname will be listed under Location.

   2. Choose an image name, which can be different from the image's name on your local machine.

   3. Combine the hostname, your Google Cloud Console project ID, and image name:

      [HOSTNAME]/[PROJECT-ID]/[IMAGE]
      

      If your project ID contains a colon (:), see Domain-scoped projects.

2. Tag the local image with the registry name by using the command:

   docker tag [SOURCE_IMAGE] [HOSTNAME]/[PROJECT-ID]/[IMAGE]
   

   where [SOURCE_IMAGE] is the local image name or image ID.

   This command names the image with the registry name and applies the tag latest. If you want to apply a different tag, then use the command:

   docker tag [SOURCE_IMAGE] [HOSTNAME]/[PROJECT-ID]/[IMAGE]:[TAG]
   

Push the tagged image to Container Registry

The Docker credential helper is the simplest way to configure Docker to authenticate directly with Container Registry. You then use the docker command to tag, push, and pull images. Alternatively, you can use the client libraries to manage container images, or you can interact directly with the Docker API.

Note: Container Registry does not support Docker chunked uploads. Some container image tools support uploading large container images with either chunked uploads or a single monolithic upload. You must use monolithic uploads when you push container images to Container Registry.

Push the tagged image to Container Registry by using the command:

docker push [HOSTNAME]/[PROJECT-ID]/[IMAGE]

This command pushes the image that has the tag latest. If you want to push an image that has a different tag, use the command:

docker push [HOSTNAME]/[PROJECT-ID]/[IMAGE]:[TAG]

When you push an image to a registry with a new hostname, Container Registry creates a storage bucket in the specified multi-regional location. After pushing your image, you can:

• Go to the Cloud Console to view the registry and image.

• Run gcloud container images list-tags to view the image's tag(s) and automatically-generated digest:

  gcloud container images list-tags [HOSTNAME]/[PROJECT-ID]/[IMAGE]
  

  The command's output is similar to the following:

  DIGEST        TAGS        TIMESTAMP
  44bde...      test        2017-..-..
  

Pulling images from a registry

To pull from Container Registry, use the command:

docker pull [HOSTNAME]/[PROJECT-ID]/[IMAGE]:[TAG]

or

docker pull [HOSTNAME]/[PROJECT-ID]/[IMAGE]@[IMAGE_DIGEST]

where:

• [HOSTNAME] is listed under Location in the console. It's one of four options: gcr.io, us.gcr.io, eu.gcr.io, or asia.gcr.io.
• [PROJECT-ID] is your Google Cloud Console project ID. If your project ID contains a colon (:), see Domain-scoped projects.
• [IMAGE] is the image's name in Container Registry.
• [TAG] is the tag applied to the image. In a registry, tags are unique to an image.
• [IMAGE_DIGEST] is the sha256 hash value of the image contents. In the console, click on the specific image to see its metadata. The digest is listed as the Image digest.

To get the pull command for a specific image:

1. Click on the name of an image to go to the specific registry.

2. In the registry, check the box next to the version of the image that you want to pull.

3. Click SHOW PULL COMMAND on the top of the page.

4. Copy the pull command, which identifies the image using either the tag or the digest.

What's next

• Learn about managing your images, including adding or removing tags and deleting images.
• Learn about configuring access control.
• Read more about Container Registry's components and features.
• If you want to run containers on Compute Engine, learn about containers on Compute Engine.