Pull a Docker image

docker pull downloads an image from a registry into the local image store:

docker pull nginx:alpine

An image reference normally contains a registry, repository, and tag. If the registry is omitted, Docker uses its configured default (commonly Docker Hub). A tag is mutable, so production deployments that need byte-for-byte repeatability should record the digest shown by docker image inspect or pull by digest when the workflow supports it.

Pulling an image does not start a container. Run it separately, for example docker run --rm -p 8080:80 nginx:alpine, and read the image documentation for required ports and environment variables. Private registries require docker login; use a credential helper and never put a password in a shell history or Dockerfile. Check the publisher and image content before running third-party software with host access.

Sources

• docker pull CLI reference

• Docker documentation