How Docker Pulls Images

1. Pulling images with docker pull

When you pull an image with docker pull {IMAGE_NAME}, there are two cases:

The IMAGE_NAME prefix points to a registry

Docker recognizes IMAGE_NAME as an image provided by the specified repository. For example, for myregistry.io/space1/image1:latest, Docker requests the image data from the server that myregistry.io points to. A Docker image is made up of many layers, and if a layer already exists locally it will not be pulled again.

The IMAGE_NAME prefix does not contain a registry

Docker recognizes IMAGE_NAME as docker.io/IMAGE_NAME and requests the image data. In fact, docker pull docker.io/shaowenchen/images1 has the same effect as docker pull shaowenchen/images1. For images provided by DockerHub, access from China is slow, and you can speed it up by adding an image mirror.

When pulling images, there may be two problems:

Pulling a non-public image prompts for login

Simply log in with docker login. In a non-interactive scenario, you can run:

1
echo "$DOCKER_PASSWORD" | docker login $REGISTRY -u "$DOCKER_USERNAME" --password-stdin

Image registry certificate error

If a registry server is specified in IMAGE_NAME but the server does not provide a valid https service, you need to configure the following:

In the /etc/docker/daemon.json file, add:

{
    "insecure-registries": ["core.harbor.chenshaowen.com:5000"]
}

Restart Docker for it to take effect.

2. Changing the image mirror to speed up pulls

Modify Docker’s configuration file daemon.json

In the /etc/docker/daemon.json file, add an image mirror

1
2
3
{
    "registry-mirrors": ["https://docker.mirrors.ustc.edu.cn"]
}

Modify Docker’s systemd parameters

Edit the file /usr/lib/systemd/system/docker.service and, on the line containing ExecStart, add the registry-mirror parameter.

1
ExecStart=... --registry-mirror=https://docker.mirrors.ustc.edu.cn

Restart Docker for it to take effect.