Docker how to download image

docker pull

Estimated reading time: 8 minutes

Pull an image or a repository from a registry

Usage

Refer to the options section for an overview of available OPTIONS for this command.

Description

Most of your images will be created on top of a base image from the Docker Hub registry.

Docker Hub contains many pre-built images that you can pull and try without needing to define and configure your own.

Proxy configuration

Concurrent downloads

For example uses of this command, refer to the examples section below.

Options

Examples

Pull an image from Docker Hub

To see which images are present locally, use the docker images command:

Docker uses a content-addressable image store, and the image ID is a SHA256 digest covering the image’s configuration and layers. In the example above, debian:jessie and debian:latest have the same image ID because they are actually the same image tagged with different names. Because they are the same image, their layers are stored only once and do not consume extra disk space.

For more information about images, layers, and the content-addressable store, refer to understand images, containers, and storage drivers.

Pull an image by digest (immutable identifier)

So far, you’ve pulled images by their name (and “tag”). Using names and tags is a convenient way to work with images. When using tags, you can docker pull an image again to make sure you have the most up-to-date version of that image. For example, docker pull ubuntu:20.04 pulls the latest version of the Ubuntu 20.04 image.

In some cases you don’t want images to be updated to newer versions, but prefer to use a fixed version of an image. Docker enables you to pull an image by its digest. When pulling an image by digest, you specify exactly which version of an image to pull. Doing so, allows you to “pin” an image to that version, and guarantee that the image you’re using is always the same.

To know the digest of an image, pull the image first. Let’s pull the latest ubuntu:20.04 image from Docker Hub:

Docker prints the digest of the image after the pull has finished. In the example above, the digest of the image is:

Docker also prints the digest of an image when pushing to a registry. This may be useful if you want to pin to a version of the image you just pushed.

A digest takes the place of the tag when pulling an image, for example, to pull the above image by digest, run the following command:

Digest can also be used in the FROM of a Dockerfile, for example:

Using this feature “pins” an image to a specific version in time. Docker will therefore not pull updated versions of an image, which may include security updates. If you want to pull an updated image, you need to change the digest accordingly.

Pull from a different registry

By default, docker pull pulls images from Docker Hub. It is also possible to manually specify the path of a registry to pull from. For example, if you have set up a local registry, you can specify its path to pull from it. A registry path is similar to a URL, but does not contain a protocol specifier ( https:// ).

The following command pulls the testing/test-image image from a local registry listening on port 5000 ( myregistry.local:5000 ):

Registry credentials are managed by docker login.

Docker uses the https:// protocol to communicate with a registry, unless the registry is allowed to be accessed over an insecure connection. Refer to the insecure registries section for more information.

Pull a repository with multiple images

This command pulls all images from the fedora repository:

After the pull has completed use the docker images command to see the images that were pulled. The example below shows all the fedora images that are present locally:

Cancel a pull

Killing the docker pull process, for example by pressing CTRL-c while it is running in a terminal, will terminate the pull operation.

The Engine terminates a pull operation when the connection between the Docker Engine daemon and the Docker Engine client initiating the pull is lost. If the connection with the Engine daemon is lost for other reasons than a manual interaction, the pull is also aborted.

Путешествие к центру… docker image. Или как скачать образ из registry без docker

За 3 дня до нового года появилась задача, передать клиенту наше ПО через менеджера, на флешке. ПО – это микросервисная платформа в несколько десятков docker-образов с множеством настроек и “километровым” helm-чартом. Что мы имели:

Пфф, подумал я! Возьму Golang, напишу программку, скомпилирую под Windows.
… и 5 часов спустя осознал поспешность своих выводов. В тот момент в первый раз вспомнился смех Нельсона. ХА-ХА! Который преследовал меня все то время, что я потратил на изучение вопроса.

Большинство найденных мной примеров требуют наличие dockerd. Два скрипта, не использующие dockerd, которые нашлись после часа гугления, раз и два. Первый вариант помог мне разобраться с процессом получения всех слоев образа и файлов конфигураций, но использовать его с Windows невозможно. А второй вариант указал, что не просто так на экране мелькают разнообразные хэши, конкретно этот FIXME. Можно было бы, конечно, на этом и остановится, работает же! Перенести на go особого труда не составит. Но как проверить, что у менеджера образы оказались именно в том виде, что и в нашем registry? А никак! Поэтому просто выложил в шаренное хранилище, скаченные с помощью команды docker save, образы и поделился ссылкой. И на этом успокоился.

На четвертый день праздников, изрядно от них устав, идея скачать и собрать правильно docker-образ настигла меня опять, и я погрузился в код moby на пару часов.

Что у меня было в этот раз:

Взяв Python «в руки» и за основу этот скрипт, решил его подправить. На второй день всё таки решил написать скрипт с нуля. Вспомнив про свои поделки для oauth-авторизации, просто скопировал часть кода оттуда, плюс сделанные уже мной наработки при правке скрипта. С авторизацией и скачиванием данных проблем не было, но появились вопросы:

Для изучения я выбрал образ ubuntu:18.04
sha256sum образа сохраненного через docker save — 257cab9137419a53359d0ed76f680fe926ed3645238357bdcdb84070a8f26cd0.

Содержимое tar-архива образа

Image config

Добавление префикса с названием алгоритма, в данном случае «sha256:», обязательно и входит в требования стандарта opencontainers, т.е. строка должна быть вида «algorithm:hash».

На вопрос по именованию директорий потратил два вечера. Достаточно длительное время я просматривал исходники docker-daemon и О! чудо! Удалось найти код генерации вот здесь и здесь. Для генерации имени директории надо вычислить хэш из json-а конфигурации слоя. У docker есть несколько версий конфигураций и до версии docker engine 1.9 использовались конфигурации версии v1. Сказано-сделано! И вот опять возникает силуэт Нельсона. После непродолжительного дебага понял, что проблема скрывалась в генерации json-а. В Python, порядок данных в словаре может отличаться от порядка данных в json генерируемого из этого словаря. Порядок данных в json будет отличаться, соответственно будет отличаться и его хэш. Пришлось перейти на OrderedDict, заранее прописать нужный порядок данных в них. Это увеличило размер кода в полтора раза.

Не совпадает размер файла, читаю https://github.com/opencontainers/image-spec/blob/master/layer.md и формат tar-архива. Дефолтное значение 10240 байт, а размер мною собранного архива больше на 9216 байт. Сначала я подумал, что надо уменьшить размер блока до 1024 байта, что оказалось неверным и в итоге размер блока 512 байт уравнял размеры архивов.

Первой строкой только что в созданном архиве фигурирует корневая папка «/». Такой вариант не подходит, поэтому дополняю код сканированием содержимого папки и добавляю по отдельности в архив, предварительно отсортировав.

В отличие от списка приведенного в начале статьи, в Linux, архив сохраняется с флагом numeric-only. В tarinfo-объекте есть две переменные отвечающие за это, tarinfo.uname и tarinfo.gname. И вторая проблема с mac os, это отсутствие группы root, она исправляется с помощью переменной tarinfo.gid в том же tarinfo-объекте. Ну вроде бы всё, создаю архив …

Для всех файлов хэш сходится, имена директорий и файлов одинаковые, атрибуты st_atime, st_mtime и st_ctime сходятся с оригиналом, права на файлы абсолютно такие же. Открыв оба архива в hex-редакторе увидел небольшое отличие:

Верхнее окно оригинал, нижнее мною собранный архив.

P.S. Пока писал статью обновился образ ubuntu:18.04 на hub.docker.com. Так что пришлось качать образ по Digest. Хэш-суммы уже не сошлись с оригиналом из-за того, что вместо тэга был записан Digest, во всё остальном это были идентичные образы.

Изображение Нельсона Манца, а так же его смех “ХА-ХА” является собственностью компании FOX 🙂

Download Docker Images without Docker Pull

Docker pull is the basic command for using Docker images. It works most of the time but sometimes it freezes in the middle of the download. Lots of people have raised issues about this with hacks that involve killing a process or restarting the docker-machine several times.

All these hacks aren’t an issue with small image sizes like the alpine distribution or an nginx image but, what about the large images? Images that weight like 500 MB or 2 GB?

These hacks aren’t useful because they involve downloading large layers over and over again.

A better workaround is to download the images manually and load them to the docker-machine. This is a much better solution as the manual download has much lower chances to fail than restarting the docker-machine hoping that docker pull starts working.

To download a docker image manually, there is a script called ‘download-frozen-image-v2.sh’ in the Moby project that lets us do that:

The Moby Project

Moby is an open-source project created by Docker to enable and accelerate software containerization.

It provides a «Lego set» of toolkit components, the framework for assembling them into custom container-based systems, and a place for all container enthusiasts and professionals to experiment and exchange ideas Components include container build tools, a container registry, orchestration tools, a runtime and more, and these can be used as building blocks in conjunction with other tools and projects.

Principles

Moby is an open project guided by strong principles, aiming to be modular, flexible and without too strong an opinion on user experience It is open to the community to help set its direction.

This script only needs three things installed:

To use the script we only need to specify the image to download and the location relative to the current:

In this example we are downloading the image «hello-world:latest» in the «example» directory.

Note: be sure to specify the version tag. If not specified, the script will return Not Found (404)

This will download several files into the «example» directory:

The only thing next to do is load it into the docker-machine. The script outputs the command necessary to do it:

Congratulations! You have pulled a docker image without the docker pull command!

Docker Images

Introduction to Docker Images

Docker Images consist of one or more read-only layers that include our application code, libraries, and dependencies needed to run the application. In other words, Images are immutable files that mean we cannot make changes to the existing image directly; either we need to re-write the Dockerfile and re-build the Docker Image with a new Dockerfile or run a container using the image and then make changes inside the container and commit the running container as a Docker Image. There are official Images available for popular OS and software such as Ubuntu, CentOS, nginx, nodejs, etc., on hub.docker.com, which is a public repository for Docker Images provided by Docker. Anyone can pull a Docker image from it; however, you must have an account on hub.docker.com in order to push images to hub.docker.com.

How do Images Work in Docker?

As mentioned above, an image consists of multiple layers; let’s understand it with an example. We want to create our own nginx Docker Image. It will consist of the below layers: –

Web development, programming languages, Software testing & others

Syntax

Example

Here is the snippet of Dockerfile to create the above image: –

Explanation

The above command will build a new Image with the name my_nginx, and the daemon considers the ‘latest’ tag as it is not specified and check the current working directory for Dockerfile.

Below is the syntax to manage the image: –

snapshot of all commands that we can use with Docker Image: –

How to Display Docker Images?

Commands to display images that are available on host locally, all below commands will give us the same output: –

docker image ls

docker image list

Here is a snippet of all options available to display Images: –

How to Download Docker Images?

We use the pull command to download Images locally.

Syntax

Example

docker pull ubuntu

The above command will pull ubuntu Image from hub.docker.com to localhost. It will pull the image that has the latest tag as shown in the below snapshot: –

If we have to download a specific tag or version of any Image, we need to specify the tag while pulling the Image.

Syntax

docker pull :tag

Example

docker pull ubuntu:xenial

The above example will download Ubuntu image which has a xenial tag with it as shown in the below snapshot: –

If we have a private registry, then we need to give the registry name, most probably the hostname on which the registry container is running. Let’s understand it with an example.

1. First, we need to create a private registry using the below command: –

Explanation: – above command creates a container with an image registry and expose it to port 5000 on the host as well as inside the container and set the restart option to always, which means the daemon will restart the container every time if the container is not running.

2. Retag existing Docker image with localhost:5000 as below: –

docker image tag ubuntu localhost:5000/ubuntu

Explanation: – above command retags the exiting ubuntu image with localhost:5000/ubuntu as we have exposed the container to localhost on 5000 port.

Note: – Docker image name must start with localhost:5000, and after / we can name it as we want, here we keep ubuntu itself.

3. Let’s push the image to our private registry: –

docker push localhost:5000/ubuntu

Explanation: – above command pushes the newly tagged Docker image to our private registry that is running as a container.

4. Now we remove the Docker image available locally: –

docker image rm localhost:5000/ubuntu

Explanation: – above command will untag the ubuntu Images that we have just tagged in the above step; however, we have already pushed this image to our private registry so we can run a container using ‘localhost:5000/ubuntu’.

5. Run a container using ‘localhost:5000/ubuntu’ as shown below: –

Explanation: – In the above snapshot, you can see daemon is pulling the image from ubuntu instead of library/ubuntu. Below are the containers that are running currently. We can see one of them is running using the ‘localhost:5000/ubuntu’ image.

How to Remove Docker Images?

We can remove any Docker Images using the ‘rm’ command if it is not referenced by any container; however, we can force remove the Images even if it is referenced by any container.

Syntax

docker image rm

docker image rm

Example

docker image rm alpine
docker image rm 82f67be598eb

Explanation: – In the above snapshot, the alpine Docker image has been removed with the latest tag. Remember, if we don’t specify the tag, it will take the latest tag. In the below snapshot, we have an alpine image with tag 3.9; if we try to remove it with the command ‘docker image rm alpine’, it will throw an error ‘No such image: alpine’; either we need to specify the tag or remove using Image ID as below: –

docker image rm alpine:3.9

docker image rm 82f67be598eb

Syntax

Example

Advantages

1. Portability – Images are portable as it includes all the required dependencies and libraries to the application, so it runs exact same way on any platform like Linux, Windows, Cloud and even Raspberry Pi.

2. Lightweight – It has a multi-layer file system that makes images extremely lightweight because each layer includes only differences from other layers.

3. Consistency – Images have powerful characteristics of inability to change; that’s called immutability. It is very useful while testing new features of any application as it is not going to break our existing image. If something goes wrong, we can run the application again using the existing image as that is unchanged. Immutability also provides the consistency that means if the application is running as expected in the test environment, then it is going to run in the same manner in other environments as well.

4. Sharing – We can store Images in a repository. We have a public repository hub.docker.com provided by Docker itself; however, we can create our own repository on hub.docker.com and keep our Images privately if we want. We can create our own private registry as well. It helps us to share images more easily

5. Secure – Docker Images are secure. Every Image has its hash value. We can also digitally sign the Images, so if someone tries to run a container using an unsigned image, the daemon is not going to start the container.

Conclusion

Docker Images are the core object of Docker. We cannot imagine Docker without images. It is the initial thing that we need to work with Docker after installing it. Images are like template or snapshot of a VM but not limited to as it has more advantages over template or snapshot.

Recommended Articles

This is a guide to Docker Images. Here we discuss How do Images Work in Docker, along with How to Display, Download and Remove images. You may also have a look at the following articles to learn more –

All in One Software Development Bundle (600+ Courses, 50+ projects)

How do I download Docker images without using the pull command?

I am blocked by the company firewall and proxy, and I can’t get a hole through it.

My problem is that I cannot use Docker to get images, that is, Docker save/pull and other Docker supplied functions since it is blocked by a firewall.

9 Answers 9

Trending sort

Trending sort is based off of the default sorting method — by highest score — but it boosts votes that have happened recently, helping to surface more up-to-date answers.

It falls back to sorting by highest score if no posts are trending.

Switch to Trending sort

On my personal laptop (OS X)

Then, I uploaded the compressed tar ball to Dropbox and downloaded on my work machine. For some reason Dropbox was open 🙂

On my work laptop (CentOS 7)

With help from the Docker Community I was able to find a resolution to my problem. What follows is my solution.

So it turns out that the Moby Project has a shell script on the Moby GitHub account which can download images from Docker Hub in a format that can be imported into Docker:

The usage syntax for the script is given by the following:

The image can then be imported with tar and docker load :

To verify that the script works as expected, I downloaded an Ubuntu image from Docker Hub and loaded it into Docker:

In practice I would have to first copy the data from the Internet client (which does not have Docker installed) to the target/destination machine (which does have Docker installed):

and then load and use the image on the target host:

I adapted a python script for having an OS independant solution: docker-drag

Use it like that, and it will create a TAR archive that you will be able to import using docker load :

Use Skopeo. It is a tool specifically made for that (and others) purpose.

After install simply execute:

Copy these files and import as you like.

If this is just a certificate issue (i.e., Firefox does access Docker Hub), try and install that certificate:

If the firewall is actively blocking any Docker pull, to the point you can’t even access Docker Hub from Firefox, then you would need to docker save / docker load an image archive. Save it from a machine where you did access Docker Hub (and where the docker pull succeeded). Load it on your corporate machine (after approval of your IT system administrators, of course).

Note: you cannot easily «just» download an image, because it is often based on top of other images which you would need to download too. That is what docker pull does for you. And that is what docker save does too (create one archive composed of all the necessary images).

[I] didn’t get my corp image to work either. But I found that I could download the Docker file and recreate the image my self from scratch. This is essentially the same as downloading the image.