docker pull

# ===== Basic pull =====
docker pull nginx:1.27-alpine
# Pulls the layers, stores them locally. Does not start anything.

# Default registry is Docker Hub. These two are equivalent:
docker pull nginx:1.27-alpine
docker pull docker.io/library/nginx:1.27-alpine

# Other registries (GHCR, ECR, GCR, ACR) need the full host:
docker pull ghcr.io/owner/repo:tag
docker pull 123456789.dkr.ecr.ap-southeast-2.amazonaws.com/app:v2

# ===== Tags vs digests =====
# Tag (moves over time):
docker pull node:20-alpine

# Digest (immutable, reproducible):
docker pull node@sha256:9c8b5f3...

# Production deploys should pin a digest. CI pulls 'latest' for a test;
# images burned into a release should reference @sha256:... .

# ===== Multi-arch =====
# Manifest lists choose the right arch for your host automatically.
# Force a specific platform:
docker pull --platform linux/arm64 redis:7-alpine
docker pull --platform linux/amd64 redis:7-alpine
# Useful on M1/M2 Macs running x86 images via emulation.

# ===== Auth =====
docker login ghcr.io -u myuser
docker login 123456789.dkr.ecr.ap-southeast-2.amazonaws.com  # creds via 'aws ecr get-login-password'
# Credentials live in ~/.docker/config.json (encrypted on Mac, plain on Linux unless you set up a keychain helper).

# ===== Inspect without pulling everything =====
# View manifest (and digest) without downloading layers:
docker buildx imagetools inspect node:20-alpine
# Useful to confirm digest before pinning.

# ===== Verify what you got =====
docker image inspect nginx:1.27-alpine | jq '.[0].RepoDigests'
# Confirms the immutable digest the tag resolves to right now.

# ===== Cleanup =====
docker image ls
docker image rm nginx:1.27-alpine
docker image prune       # untagged + dangling images
docker image prune -a    # everything not currently used by a container

# ===== Patterns to internalise =====
# - Pin digests in production manifests; tags drift, digests do not
# - Always include --platform when building/pulling on a cross-arch host
# - 'docker pull' before 'docker run' on a slow link so the timing of run is predictable
# - Inspect with buildx imagetools before bumping a deploy

# ===== Pitfalls =====
# - 'latest' tag in production -> non-reproducible deploys, hard to roll back
# - Pulling on a tiny disk and getting ENOSPC mid-download
# - Logging into a registry on shared CI without scoping the credential
# - Forgetting --platform on an M1 Mac -> runs slowly under qemu emulation

docker pull postgres:16
docker pull mongo:7
docker pull node:20-alpine