# docker login Command Reference

> Reference for docker login in CI: authenticate to a registry with -u and --password-stdin to avoid leaking credentials in process listings or logs.

Source: https://latchkey.dev/learn/command-reference/docker-login-command-reference  
Updated: 2026-06-26

Authenticate the Docker CLI to a registry.

docker login stores credentials for a registry so subsequent pull and push commands are authorized. The registry argument defaults to Docker Hub; pass a host for any other registry. In CI, feed the secret over stdin rather than as a -p argument.

## Common flags

- `-u, --username` - registry username
- `-p, --password` - password (avoid in CI; visible in process list)
- `--password-stdin` - read the password from stdin (safe for CI)
- Positional registry host, e.g. ghcr.io (omit for Docker Hub)

## Example

```shell
echo "${{ secrets.DOCKERHUB_TOKEN }}" | docker login -u "${{ secrets.DOCKERHUB_USER }}" --password-stdin
echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u "${{ github.actor }}" --password-stdin
```

## In CI

Always use --password-stdin. Passing -p PASSWORD puts the secret in the process argument list and can leak into logs or ps output; the CLI warns about exactly this. Pipe the token in with echo or printf so it never appears as an argument.

## FAQ

### docker login Command Reference?

docker login stores credentials for a registry so subsequent pull and push commands are authorized. The registry argument defaults to Docker Hub; pass a host for any other registry. In CI, feed the secret over stdin rather than as a -p argument.

### In CI?

Always use --password-stdin. Passing -p PASSWORD puts the secret in the process argument list and can leak into logs or ps output; the CLI warns about exactly this. Pipe the token in with echo or printf so it never appears as an argument.

---

Latchkey runs CI/CD that repairs its own failures. Agent entry points: https://latchkey.dev/agent.txt, https://latchkey.dev/openapi.json, https://latchkey.dev/llms.txt