docker push Command Reference

Upload a local image to a registry.

docker push uploads an image (and its layers not already present) to the registry encoded in its tag. The tag must include the registry host for anything other than Docker Hub, and you must be authenticated via docker login first.

Common flags

-a, --all-tags - push every tag of the named repository
-q, --quiet - suppress verbose layer output
--disable-content-trust - push without signing (default true)

Example

shell

docker tag app:build ghcr.io/myorg/app:${{ github.sha }}
docker push ghcr.io/myorg/app:${{ github.sha }}
docker tag app:build ghcr.io/myorg/app:latest
docker push ghcr.io/myorg/app:latest

In CI

Push an immutable SHA tag for every build and a moving tag (latest, or the branch name) only on the appropriate branch. "denied: requested access to the resource is denied" means the image tag does not match an authenticated registry/namespace, or login did not run for that registry.

Key takeaways

The image tag must contain the registry host; push only uploads layers the registry lacks.
docker login must run for the target registry before push.
Push both an immutable SHA tag and a moving tag like latest.