Pulling Images Using the Docker CLI
Find out how to pull images from Container Registry using the Docker CLI.
You use the Docker CLI to pull images from Oracle Cloud Infrastructure Registry (also known as Container Registry).
Your permissions control the images you can pull from Container Registry (see Policies to Control Repository Access). You can pull images from repositories you've created, from public repositories, and from repositories that the groups to which you belong have been granted access by identity policies. If you belong to the Administrators group, you can pull images from any repository in the tenancy.
Container Registry is an Open Container Initiative-compliant registry. As a result, you can store any artifacts that conform to Open Container Initiative specifications, such as Docker images, manifest lists (sometimes known as multi-architecture images), and Helm charts. The instructions in this topic assume you are storing Docker images and using the Docker CLI.
To pull images from Container Registry using the Docker CLI:
If you already have an auth token, go to the next step. Otherwise:
- In the top-right corner of the Console, open the Profile menu and then click User settings to view the details.
- On the Auth Tokens page, click Generate Token.
- Enter a friendly description for the auth token. Avoid entering confidential information.
- Click Generate Token. The new auth token is displayed.
- Copy the auth token immediately to a secure location from where you can retrieve it later, because you won't see the auth token again in the Console.
- Close the Generate Token dialog.
In a terminal window on the client machine running Docker, log in to Container Registry by entering
docker login <region-key>.ocir.io, where
<region-key>corresponds to the key for the Container Registry region you're using. For example,
docker login iad.ocir.io. See Availability by Region.
- When prompted for a username, enter your username in the format
<tenancy-namespace>is the auto-generated Object Storage namespace string of your tenancy (as shown on the Tenancy Information page). For example,
firstname.lastname@example.org. If your tenancy is federated with Oracle Identity Cloud Service, use the format
- When prompted for a password, enter the auth token you copied earlier.
Pull the Docker image from Container Registry to the client machine by entering:
docker pull <region-key>.ocir.io/<tenancy-namespace>/<repo-name>:<version>
<region-key>is the key for the Container Registry region you're using. For example,
iad. See Availability by Region.
ocir.iois the Container Registry name.
<tenancy-namespace>is the auto-generated Object Storage namespace string of the tenancy that owns the repository from which you want to pull the image (as shown on the Tenancy Information page). For example, the namespace of the acme-dev tenancy might be
ansh81vru1zp. Note that for some older tenancies, the namespace string might be the same as the tenancy name in all lower-case letters (for example,
acme-dev). Note also that your user must have access to the tenancy.
<repo-name>is the name of a repository from which you want to pull the image (for example,
project01/acme-web-app). Note that your user must have access to the repository (see Repositories).
<version>is the version identifier of the image that you want to pull from Container Registry (for example,
docker pull iad.ocir.io/ansh81vru1zp/project01/acme-web-app:v2.0.test
Note that if you don't specify a
docker pullcommand, Docker pulls the image that has the
Confirm that the image has been pulled from Container Registry by entering
docker imagesand verifying that the list of images on the client machine now includes the image you just pulled.
$ docker images REPOSITORY TAG IMAGE ID CREATED SIZE iad.ocir.io/ansh81vru1zp/project01/acme-web-app v2.0.test 8e0506e14874 1 minute ago 162.6 MB acme-web-app latest 8e0506e14874 2 hours ago 162.6 MB acme-web-app v1.0 7d9495d03763 2 hours ago 162.6 MB <none> <none> 6ebd328f833d 5 hours ago 162.6 MB hello-world latest 80b84820d442 5 weeks ago 890 B