Tag and push an image to a private registry

WHAT THIS TESTS This checks practical fluency with the image naming scheme and the tag-push lifecycle, including authenticating to a non-Hub registry.

A GOOD ANSWER COVERS An image reference is registry-host/repository:tag, and the absence of a host defaults to Docker Hub. To push elsewhere you first authenticate, then retag so the name points at the target registry, then push. For Amazon ECR you obtain a short-lived token and feed it to docker login, for example aws ecr get-login-password piped into docker login --username AWS --password-stdin against the registry host. Retag with docker tag my-app:local 123456789012.dkr.ecr.us-east-1.amazonaws.com/my-app:1.0.0. Finally docker push 123456789012.dkr.ecr.us-east-1.amazonaws.com/my-app:1.0.0. The repository must already exist in ECR. Use an immutable version tag rather than latest.

COMMON WRONG ANSWERS Running docker push my-app, which tries to push to Docker Hub under your username. Skipping docker login and getting a denied or unauthorized error. Assuming docker build automatically targets the registry. Pushing only the latest tag.

LIKELY FOLLOW-UPS Why does the bare name go to Docker Hub? How long is an ECR token valid? Can you set the registry name at build time with -t? What happens if the ECR repository does not exist?

ONE CONCRETE EXAMPLE You built my-app:local. You authenticate with aws ecr get-login-password --region us-east-1 piped to docker login --username AWS --password-stdin 123456789012.dkr.ecr.us-east-1.amazonaws.com. You retag: docker tag my-app:local 123456789012.dkr.ecr.us-east-1.amazonaws.com/my-app:1.0.0. You push: docker push 123456789012.dkr.ecr.us-east-1.amazonaws.com/my-app:1.0.0. The registry now holds the versioned image ready for deployment.