Container registries: public vs private
image distribution and governance.
a registry stores and serves versioned image layers by digest; public registries are open and rate-limited, private ones add access control, scanning, signing and network isolation.
What's really being asked
Whether you understand the registry's role in the image lifecycle and the operational and security reasons teams run private registries.
The full answer
A container registry is a server that stores and serves container images, which are sets of content-addressed layers plus a manifest, organized into repositories and referenced by tag or immutable digest. Clients push built images to it and nodes pull them to run. Public registries such as Docker Hub are openly readable, convenient for popular base and official images, but they impose pull rate limits, expose you to typosquatting and unvetted images, and put a third party in your critical path. Private registries such as AWS ECR or self-hosted Harbor add authentication and authorization so only permitted identities push or pull, integrated vulnerability scanning, image signing and policy enforcement, replication across regions for availability and pull-through caching of upstream images, plus the ability to live inside your network for compliance and lower latency. The format and protocol are the same OCI standard; the differences are access, trust, performance and control.
The mistakes people make
Confusing a registry with a single repository; a registry hosts many repositories. Conflating the registry with the build tool or CI; building and storing are separate steps. Believing public images are inherently safe, ignoring rate limits and supply-chain exposure. Thinking a private registry changes the image format rather than adding governance.
What usually comes next
Why pin by digest rather than a mutable tag? How do pull-through cache and replication improve reliability? How do scanning and signing fit a supply-chain security story? How do you authenticate nodes to a private registry, for example via imagePullSecrets or IAM?
A concrete example
A team pulls the official postgres base from Docker Hub but hits anonymous pull rate limits during a deploy. They stand up Harbor as a pull-through cache and private registry, scan and sign every internal image, restrict pushes to CI's identity, and replicate to a second region. Deploys now pull from inside the network with no external rate limit and a verified provenance chain.
Interview question
A startup moves from Docker Hub to a private registry like Harbor or ECR. Which is the most accurate reason this matters beyond convenience?
- a.Private registries use a different, incompatible image format
- b.They make the docker build step unnecessary
- c.Public registries cannot store more than one repository
- d.They add access control, scanning, signing, and isolation that public registries lackCorrect
Why? this is the answer
Both use the same OCI image format; the difference is governance: private registries add authentication, vulnerability scanning, signing, replication and network isolation. They do not replace building or change the image format.
Just read this? Test yourself on what you have been reading.
Read the original → docs.docker.com
- #containers
- #registry
- #docker-hub
- #ecr
- #supply-chain
You just looked this up. Could you explain it out loud?
That is the part interviews actually test. Tezvyn takes questions like this one and gives you what the interviewer is really checking, the answer that lands, and the mistake that ends the conversation, in the four minutes before your next meeting.
The iPhone app is on the way
We are building it. Until it lands, nothing here is held back from you: every interview card, your saved cards, streaks and the job board all work in Safari, plus hundreds of free practice quizzes of thirty questions each. Sign in and it all carries over to the app the day it arrives.
Want it as an icon? Tap Share at the bottom of Safari, then Add to Home Screen. It opens full screen and the cards you have read stay available offline.
We are hiring for this. Open roles that interview on containers — each one lists the topics its interview covers.
See open roles