9 Public and private software distribution

This chapter explains how Docker images are shared and installed by others, presenting distribution as a spectrum from fully hosted services to custom-built pipelines and source sharing. Because no single method fits every use case, it introduces a set of practical selection criteria—cost, visibility, transport performance, longevity and availability control, access control, artifact integrity and confidentiality, and requisite expertise—to help you make informed trade-offs. A key theme is that all options build on Docker’s core tooling, so teams can migrate between methods as requirements change.

On the simplest end, hosted registries (public and private) make publishing straightforward. Public repositories are typically free, highly visible, and efficient thanks to layer-aware transfers, but you give up availability control and must never treat them as a place for secrets. Private hosted repositories add access controls and suit small teams, yet still leave availability and longevity in a provider’s hands. Running your own private registry shifts control to you—supporting regional caches, team- or environment-specific pools, and stricter secrecy—while preserving familiar push/pull workflows and integrity features. The trade-off is operational responsibility for storage, security (TLS, auth, encryption at rest), scale, and uptime.

Moving further along the spectrum, manual distribution treats images as files moved through any channel (from cloud storage to USB), maximizing flexibility for air-gapped or unusual environments but sacrificing registry benefits like layer deduplication, parallelism, and built-in integrity; security and integrity depend on your added processes (signing, checksums, encryption). The most flexible approach is distributing sources (for example, Dockerfiles via version control) and letting consumers build locally, which can reduce transport size by leveraging existing base images and improve discoverability for public projects, while offering no availability control and placing more build and tooling burden on producers and consumers. Selecting a method ultimately means applying the chapter’s criteria to your constraints and choosing the balance of simplicity, performance, security, and control you need.

The image distribution spectrum

The simplest side of the distribution spectrum and the topic of this section

Private registries in the image distribution spectrum

Interactions between the docker client, daemon, local registry container, and local storage

Docker image distribution over custom infrastructure

A typical manual distribution workflow with producer, transport, and consumers

An FTP publishing infrastructure

Using existing infrastructure to distribute image sources

• Having a spectrum of choices illustrates your range of options.
• You should use a consistent set of selection criteria in order to evaluate your distribution options and determine which method you should use.
• Hosted public repositories provide excellent project visibility, are free, and require very little experience to adopt.
• Consumers will have a higher degree of trust in images generated by automated builds because a trusted third party builds them.
• Hosted private repositories are cost-effective for small teams and provide satisfactory access control.
• Running your own registry enables you to build infrastructure suitable for special use cases without abandoning the Docker distribution facilities.
• Distributing images as files can be accomplished with any file-sharing system.
• Image source distribution is flexible but only as complicated as you make it. Using popular source-distribution tools and patterns will keep things simple.

FAQ