Download an image from a registry
$ docker pull [OPTIONS] NAME[:TAG|@DIGEST]
Most of your images will be created on top of a base image from the Docker Hub registry.
Docker Hub contains many pre-built images that you
pull and try without needing to define and configure your own.
To download a particular image, or set of images (i.e., a repository),
If you are behind an HTTP proxy server, for example in corporate settings,
before open a connect to registry, you may need to configure the Docker
daemon’s proxy settings, using the
environment variables. To set these environment variables on a host using
systemd, refer to the control and configure Docker with systemd
for variables configuration.
By default the Docker daemon will pull three layers of an image at a time.
If you are on a low bandwidth connection this may cause timeout issues and you may want to lower
this via the
--max-concurrent-downloads daemon option. See the
daemon documentation for more details.
For example uses of this command, refer to the examples section below.
||Download all tagged images in the repository|
||Skip image verification|
||Set platform if server is multi-platform capable|
||Suppress verbose output|
Pull an image from Docker Hub
To download a particular image, or set of images (i.e., a repository), use
docker image pull (or the
docker pull shorthand). If no tag is provided,
Docker Engine uses the
:latest tag as a default. This example pulls the
$ docker image pull debian Using default tag: latest latest: Pulling from library/debian e756f3fdd6a3: Pull complete Digest: sha256:3f1d6c17773a45c97bd8f158d665c9709d7b29ed7917ac934086ad96f92e4510 Status: Downloaded newer image for debian:latest docker.io/library/debian:latest
Docker images can consist of multiple layers. In the example above, the image
consists of a single layer;
Layers can be reused by images. For example, the
debian:bullseye image shares
its layer with the
debian:latest. Pulling the
debian:bullseye image therefore
only pulls its metadata, but not its layers, because the layer is already present
$ docker image pull debian:bullseye bullseye: Pulling from library/debian Digest: sha256:3f1d6c17773a45c97bd8f158d665c9709d7b29ed7917ac934086ad96f92e4510 Status: Downloaded newer image for debian:bullseye docker.io/library/debian:bullseye
To see which images are present locally, use the
$ docker images REPOSITORY TAG IMAGE ID CREATED SIZE debian bullseye 4eacea30377a 8 days ago 124MB debian latest 4eacea30377a 8 days ago 124MB
Docker uses a content-addressable image store, and the image ID is a SHA256
digest covering the image’s configuration and layers. In the example above,
debian:latest have the same image ID because they are
the same image tagged with different names. Because they are the same image,
their layers are stored only once and do not consume extra disk space.
For more information about images, layers, and the content-addressable store, refer to understand images, containers, and storage drivers.
Pull an image by digest (immutable identifier)
So far, you’ve pulled images by their name (and “tag”). Using names and tags is
a convenient way to work with images. When using tags, you can
docker pull an
image again to make sure you have the most up-to-date version of that image.
docker pull ubuntu:22.04 pulls the latest version of the Ubuntu
In some cases you don’t want images to be updated to newer versions, but prefer to use a fixed version of an image. Docker enables you to pull an image by its digest. When pulling an image by digest, you specify exactly which version of an image to pull. Doing so, allows you to “pin” an image to that version, and guarantee that the image you’re using is always the same.
To know the digest of an image, pull the image first. Let’s pull the latest
ubuntu:22.04 image from Docker Hub:
$ docker pull ubuntu:22.04 22.04: Pulling from library/ubuntu 125a6e411906: Pull complete Digest: sha256:26c68657ccce2cb0a31b330cb0be2b5e108d467f641c62e13ab40cbec258c68d Status: Downloaded newer image for ubuntu:22.04 docker.io/library/ubuntu:22.04
Docker prints the digest of the image after the pull has finished. In the example above, the digest of the image is:
Docker also prints the digest of an image when pushing to a registry. This may be useful if you want to pin to a version of the image you just pushed.
A digest takes the place of the tag when pulling an image, for example, to pull the above image by digest, run the following command:
$ docker pull ubuntu@sha256:26c68657ccce2cb0a31b330cb0be2b5e108d467f641c62e13ab40cbec258c68d docker.io/library/ubuntu@sha256:26c68657ccce2cb0a31b330cb0be2b5e108d467f641c62e13ab40cbec258c68d: Pulling from library/ubuntu Digest: sha256:26c68657ccce2cb0a31b330cb0be2b5e108d467f641c62e13ab40cbec258c68d Status: Image is up to date for ubuntu@sha256:26c68657ccce2cb0a31b330cb0be2b5e108d467f641c62e13ab40cbec258c68d docker.io/library/ubuntu@sha256:26c68657ccce2cb0a31b330cb0be2b5e108d467f641c62e13ab40cbec258c68d
Digest can also be used in the
FROM of a Dockerfile, for example:
FROM ubuntu@sha256:26c68657ccce2cb0a31b330cb0be2b5e108d467f641c62e13ab40cbec258c68d LABEL org.opencontainers.image.authors="some maintainer <email@example.com>"
Using this feature “pins” an image to a specific version in time. Docker does therefore not pull updated versions of an image, which may include security updates. If you want to pull an updated image, you need to change the digest accordingly.
Pull from a different registry
docker pull pulls images from Docker Hub. It is also possible to
manually specify the path of a registry to pull from. For example, if you have
set up a local registry, you can specify its path to pull from it. A registry
path is similar to a URL, but does not contain a protocol specifier (
The following command pulls the
testing/test-image image from a local registry
listening on port 5000 (
$ docker image pull myregistry.local:5000/testing/test-image
Registry credentials are managed by docker login.
Docker uses the
https:// protocol to communicate with a registry, unless the
registry is allowed to be accessed over an insecure connection. Refer to the
insecure registries section for more information.
Pull a repository with multiple images (-a, --all-tags)
docker pull pulls a single image from the registry. A repository
can contain multiple images. To pull all images from a repository, provide the
--all-tags) option when using
This command pulls all images from the
$ docker image pull --all-tags ubuntu Pulling repository ubuntu ad57ef8d78d7: Download complete 105182bb5e8b: Download complete 511136ea3c5a: Download complete 73bd853d2ea5: Download complete .... Status: Downloaded newer image for ubuntu
After the pull has completed use the
docker image ls command (or the
shorthand) to see the images that were pulled. The example below shows all the
ubuntu images that are present locally:
$ docker image ls --filter reference=ubuntu REPOSITORY TAG IMAGE ID CREATED SIZE ubuntu 18.04 c6ad7e71ba7d 5 weeks ago 63.2MB ubuntu bionic c6ad7e71ba7d 5 weeks ago 63.2MB ubuntu 22.04 5ccefbfc0416 2 months ago 78MB ubuntu focal ff0fea8310f3 2 months ago 72.8MB ubuntu latest ff0fea8310f3 2 months ago 72.8MB ubuntu jammy 41ba606c8ab9 3 months ago 79MB ubuntu 20.04 ba6acccedd29 7 months ago 72.8MB
Cancel a pull
docker pull process, for example by pressing
CTRL-c while it is
running in a terminal, will terminate the pull operation.
$ docker pull ubuntu Using default tag: latest latest: Pulling from library/ubuntu a3ed95caeb02: Pulling fs layer 236608c7b546: Pulling fs layer ^C
The Engine terminates a pull operation when the connection between the daemon and the client (initiating the pull) is cut or lost for any reason or the command is manually terminated.