5 exercises — Master the English vocabulary of container registries: image naming anatomy, digest pinning, multi-platform manifests, authentication, and vulnerability scanning.
0 / 20 completed
1 / 20
A runbook entry reads: "Pull the application image using its fully-qualified name: registry.company.com/platform/api-server:v2.5.1"
What does each component of this image reference represent?
A fully-qualified image name follows the pattern: registry/namespace/repository:tag.
Breaking down registry.company.com/platform/api-server:v2.5.1:
• registry.company.com — the registry hostname (where the image is stored)
• platform — the namespace or organisation grouping related repositories
• api-server — the repository name (the image itself)
• v2.5.1 — the tag identifying a specific version
When the registry is omitted, Docker defaults to docker.io. When the tag is omitted, Docker defaults to latest — a mutable tag that should not be used in production because it may reference different image content over time.
Key vocabulary:
• registry — a server that stores and distributes container images (Docker Hub, ECR, GCR, GHCR)
• namespace — a grouping within a registry, typically an organisation, team, or project
• repository — a collection of images sharing a name but differing by tag
• tag — a human-readable label for a specific image version within a repository
• fully-qualified image name — the complete reference including registry, namespace, repository, and tag
2 / 20
A security engineer writes in a hardening guide: "Don't pin base images by tag — tags are mutable and can be silently reassigned. Pin by digest: FROM node:20-alpine@sha256:4a7b9f... — then the image never changes under you."
What is a container image digest?
A digest is a content-addressed, immutable identifier — unlike tags, it cannot be reassigned.
An image's digest is computed from its manifest — the JSON document describing layers, configuration, and media type. Because the hash is derived from the content, any change to the image produces a different digest. As long as you reference the same digest, you are guaranteed to receive the exact same image bytes every time — even if the registry operator reassigns the tag to a different image.
Tags, by contrast, are mutable pointers. The tag latest or v1.2 can be reassigned at any time. Supply-chain attacks have exploited this by pushing malicious images to popular tags. Pinning by digest eliminates this risk entirely.
Key vocabulary:
• digest — a SHA-256 hash of an image manifest; immutable, content-addressed identifier
• content-addressed — an addressing scheme where the identifier is derived from the content itself, guaranteeing integrity
• tag — a mutable human-readable label that can be reassigned to different image versions at any time
• manifest — a JSON document describing an image's layers, configuration, and media type
• pin by digest — the practice of referencing an image by its digest rather than a mutable tag, for build reproducibility
3 / 20
A DevOps engineer explains: "We push a multi-platform image supporting both linux/amd64 CI runners and linux/arm64 developer laptops. The registry stores a manifest list that points to platform-specific manifests — so docker pull automatically fetches the right variant."
What is a manifest list?
A manifest list (OCI index) is a higher-level manifest that references per-platform image manifests.
When you build and push a multi-platform image (combining linux/amd64 and linux/arm64 builds), each platform variant is stored as a separate image manifest with its own digest. A manifest list (now formally an OCI Image Index) sits above these, mapping each platform descriptor to its manifest. When a client runs docker pull myimage:latest, Docker reads the manifest list and automatically downloads the manifest corresponding to the client's OS and CPU architecture.
This allows the same image reference to work on Intel servers, Apple Silicon Macs, and ARM64 Raspberry Pis — without the developer specifying a platform-specific tag. Built using docker buildx build --platform linux/amd64,linux/arm64.
Key vocabulary:
• manifest list — an OCI index containing references to platform-specific image manifests under a single name
• multi-platform image — a single image reference that supports multiple OS/architecture combinations
• platform descriptor — the OS (linux, windows) and architecture (amd64, arm64) specification within a manifest list
• OCI — Open Container Initiative; the industry standard for container image and runtime specifications
• docker buildx — Docker's extended build tool that supports multi-platform builds
4 / 20
A CI pipeline fails with: "Error response from daemon: pull access denied, repository does not exist or may require 'docker login'". A teammate says: "Use a registry service account with scoped push/pull permissions — store its access token as a CI secret and pass it to docker login --password-stdin."
What is the recommended approach for CI/CD registry authentication?
Service accounts with scoped tokens are the secure standard for CI/CD registry authentication.
Best practices for registry auth in CI/CD:
• Use a service account (robot account in Harbor/Nexus, ECR IAM role, GCP service account) — a non-human identity with scoped permissions
• Grant only what's needed: pull-only for deployment steps; push+pull for build steps
• Store the token in the CI system's encrypted secrets store (GitHub Actions secrets, GitLab CI variables)
• Authenticate with echo "$TOKEN" | docker login --username robot --password-stdin — --password-stdin prevents the token from appearing in shell history or process listings
Embedding credentials in Dockerfiles (A) exposes them in layer history, image metadata, and git history — a serious security vulnerability. --no-auth (D) does not exist as a Docker flag.
Key vocabulary:
• service account / robot account — a non-human account used by automated systems, with scoped registry permissions
• access token — a credential with specific scopes and an expiry date, used instead of a password
• --password-stdin — passes the registry password via stdin, avoiding it appearing in shell history
• least privilege — granting only the minimum permissions required for the task
• CI secret — an encrypted environment variable stored in the CI system, not visible in logs
5 / 20
A CI pipeline posts a security report: "Trivy scan on api-server:v2.5.1 found 3 HIGH and 1 CRITICAL CVE in base OS packages. Recommend update to node:20-alpine latest and rebuild."
What is the correct professional response to this finding?
The professional workflow for CVE findings: triage → remediate → verify → document.
When an image scan surfaces vulnerabilities:
1. Triage by severity: CRITICAL and HIGH need immediate action; MEDIUM/LOW can be tracked
2. Remediate: update the vulnerable base image or specific package to a patched version
3. Rebuild: run docker build with the updated base
4. Rescan: run Trivy (or your scanner) again to confirm the CVEs are gone
5. Document: record the CVE IDs and fix in the PR description or changelog
Marking as false positive without investigation (A), switching image types to evade detection (B), or disabling the scanner (C) are security anti-patterns that violate basic secure development practices.
Key vocabulary:
• CVE — Common Vulnerabilities and Exposures; a public identifier for a specific security vulnerability
• CRITICAL / HIGH — severity ratings indicating high exploitability or significant impact
• Trivy — an open-source container and filesystem vulnerability scanner by Aqua Security
• remediation — fixing a vulnerability, typically by updating the affected package or base image
• deployment gate — a CI/CD check that blocks deployment if security or quality criteria are not met
6 / 20
Sarah: "Hey team, I'm trying to deploy a new version of our microservice, `user-management`, and it's failing. The error message says 'Image not found in registry'. I've checked the registry URL (`myregistry.example.com/services/user-management:latest`) but it seems to be resolving correctly. Any ideas?"
Considering Sarah's problem, which of the following is the MOST likely reason the image isn't being found, assuming the registry URL itself is correct?
Sarah's issue points towards ambiguity within Docker image tagging. The `latest` tag is a convention often used but isn't inherently precise; it can resolve to different images depending on the registry configuration and the client's interpretation. While network issues and authentication *could* contribute, the core problem here lies in the lack of specificity within the tag itself, causing Docker to fail to definitively locate the intended image. Using a versioned tag (e.g., `:v1.2.3`) would provide far greater clarity.
7 / 20
Liam, a developer, is reviewing a PR that uses the Docker CLI to pull an image from our private container registry. He sees this line in the commit message: `docker pull myregistry.internal/backend/api:v1.2`. Liam knows we use tags for versioning but wants to ensure the command is correct and secure.
Which of the following statements best describes the purpose of the myregistry.internal part of this Docker command?
The myregistry.internal part is crucial because it defines the *repository name* within our private container registry. This uniquely identifies the image repository and tells Docker where to find the specific image being pulled. Option A describes a performance optimization which isn't relevant here; options B, C, and D are incorrect – tags are for versioning, authentication tokens are handled separately by Docker login, and the port number is usually configured within the registry itself, not part of the URL.
8 / 20
Sarah: "Hey team, I'm trying to deploy a new version of our microservice, `user-management`, and it's failing. The error message says 'Image not found in registry'. I've checked the registry URL (`myregistry.example.com/services/user-management:latest`) but it seems to be resolving correctly. Any ideas?"
Considering Sarah's problem, which of the following is the MOST likely reason the image isn't being found, assuming the registry URL itself is correct?
Sarah's issue points towards ambiguity within Docker image tagging. The `latest` tag is a convention often used but isn't inherently precise; it can resolve to different images depending on the registry configuration and the client's interpretation. While network issues and authentication *could* contribute, the core problem here lies in the lack of specificity within the tag itself, causing Docker to fail to definitively locate the intended image. Using a versioned tag (e.g., `:v1.2.3`) would provide far greater clarity.
9 / 20
Liam, a developer, is reviewing a PR that uses the Docker CLI to pull an image from our private container registry. He sees this line in the commit message: `docker pull myregistry.internal/backend/api:v1.2`. Liam knows we use tags for versioning but wants to ensure the command is correct and secure.
Which of the following statements best describes the purpose of the myregistry.internal part of this Docker command?
The myregistry.internal part is crucial because it defines the *repository name* within our private container registry. This uniquely identifies the image repository and tells Docker where to find the specific image being pulled. Option A describes a performance optimization which isn't relevant here; options B, C, and D are incorrect – tags are for versioning, authentication tokens are handled separately by Docker login, and the port number is usually configured within the registry itself, not part of the URL.
10 / 20
Sarah: "Hey team, I'm trying to deploy a new version of our microservice, `user-management`, and it's failing. The error message says 'Image not found in registry'. I've checked the registry URL (`myregistry.example.com/services/user-management:latest`) but it seems to be resolving correctly. Any ideas?"
Considering Sarah's problem, which of the following is the MOST likely reason the image isn't being found, assuming the registry URL itself is correct?
Sarah's issue points towards ambiguity within Docker image tagging. The `latest` tag is a convention often used but isn't inherently precise; it can resolve to different images depending on the registry configuration and the client's interpretation. While network issues and authentication *could* contribute, the core problem here lies in the lack of specificity within the tag itself, causing Docker to fail to definitively locate the intended image. Using a versioned tag (e.g., `:v1.2.3`) would provide far greater clarity.
11 / 20
Liam, a developer, is reviewing a PR that uses the Docker CLI to pull an image from our private container registry. He sees this line in the commit message: `docker pull myregistry.internal/backend/api:v1.2`. Liam knows we use tags for versioning but wants to ensure the command is correct and secure.
Which of the following statements best describes the purpose of the myregistry.internal part of this Docker command?
The myregistry.internal part is crucial because it defines the *repository name* within our private container registry. This uniquely identifies the image repository and tells Docker where to find the specific image being pulled. Option A describes a performance optimization which isn't relevant here; options B, C, and D are incorrect – tags are for versioning, authentication tokens are handled separately by Docker login, and the port number is usually configured within the registry itself, not part of the URL.
12 / 20
Sarah: "Hey team, I'm trying to deploy a new version of our microservice, `user-management`, and it's failing. The error message says 'Image not found in registry'. I've checked the registry URL (`myregistry.example.com/services/user-management:latest`) but it seems to be resolving correctly. Any ideas?"
Considering Sarah's problem, which of the following is the MOST likely reason the image isn't being found, assuming the registry URL itself is correct?
Sarah's issue points towards ambiguity within Docker image tagging. The `latest` tag is a convention often used but isn't inherently precise; it can resolve to different images depending on the registry configuration and the client's interpretation. While network issues and authentication *could* contribute, the core problem here lies in the lack of specificity within the tag itself, causing Docker to fail to definitively locate the intended image. Using a versioned tag (e.g., `:v1.2.3`) would provide far greater clarity.
13 / 20
Liam, a developer, is reviewing a PR that uses the Docker CLI to pull an image from our private container registry. He sees this line in the commit message: `docker pull myregistry.internal/backend/api:v1.2`. Liam knows we use tags for versioning but wants to ensure the command is correct and secure.
Which of the following statements best describes the purpose of the myregistry.internal part of this Docker command?
The myregistry.internal part is crucial because it defines the *repository name* within our private container registry. This uniquely identifies the image repository and tells Docker where to find the specific image being pulled. Option A describes a performance optimization which isn't relevant here; options B, C, and D are incorrect – tags are for versioning, authentication tokens are handled separately by Docker login, and the port number is usually configured within the registry itself, not part of the URL.
14 / 20
A developer is using Docker Compose to orchestrate a multi-container application. They receive the following error message: 'Error response from daemon: Bad syntax in Dockerfile'. What's the most likely cause?
Docker Compose relies on YAML for configuration. 'Bad syntax' strongly suggests an error in the YAML structure – invalid indentation, missing colons, or incorrectly formatted keys are common causes. The other options represent potential issues but aren't as directly related to the error message.
15 / 20
Reviewing a code review comment from David: 'The image tag `myregistry.com/app-server:latest` is too broad! We should always use specific tags to ensure consistent deployments and avoid unexpected changes. Consider pinning it to a digest or a version number.' What does David mean by 'pinning' an image in this context?
David is referring to using a cryptographic hash (SHA256 digest) of the image. This creates a unique identifier that remains constant even if the underlying image content changes. Using 'latest' can lead to unpredictable behavior because it doesn't guarantee a specific version, and pinning guarantees reproducibility.
16 / 20
Maria sends this message in the #devs Slack channel: 'I'm getting errors pulling my new container image. I've verified the registry URL and credentials, but it still fails with 'Image not found'. Anyone have experience with this?'. What is Maria *most likely* encountering?
Maria's error message – 'Image not found' – strongly suggests a permissions issue. The Docker daemon needs appropriate access to pull images from the specified registry. While other issues are possible, incorrect credentials or an invalid image name are more frequently related to this specific error and her description.
17 / 20
During a standup meeting, Ben says: "I'm having trouble deploying the new `payment-processor` image. It keeps failing with 'Image not found in registry'. I've confirmed the URL is correct and my credentials are valid."
Ben's error message strongly suggests a missing or incorrect image name specification. While transient registry issues can occur, confirming the full name (repository + tag) is the first and most common troubleshooting step. The other options introduce irrelevant considerations – network problems are less likely given the credentials check, and mis-built images aren't immediately apparent from a simple URL/credentials verification.
18 / 20
Reviewing a pull request description for a change to update a container image, you see the following: 'Updated the base image to `python:3.9-slim` and rebuilt the application. The new tag is `myregistry.com/app-service:v2.1`. This ensures consistent deployments across all environments.' What does this description primarily highlight?
This description emphasizes using specific tags. Employing immutable tags is crucial for container image management – it guarantees consistent deployments by preventing tag mutations. While the other options are valid practices in DevOps, this particular sentence directly addresses the core concept of tagging and its role in stability.
19 / 20
A teammate, Alex, sends a Slack message: 'I'm getting an 'Image not found' error when trying to deploy my new container. I've checked the registry URL and confirmed that I'm logged in correctly. The image is named `private-repo/my-app:latest`. Any thoughts?' What's the BEST immediate response?
While DNS issues are possible, Alex has already verified the URL. The 'latest' tag is a common pitfall – using it introduces ambiguity and potential for unexpected changes. Requesting the command allows you to identify syntax errors or incorrect image names, but addressing the `latest` tag directly provides immediate guidance on a frequent problem.
20 / 20
You're configuring a CI/CD pipeline to deploy your application using Docker images stored in a private registry. The pipeline uses the following command: `docker push myregistry.com/my-app:v1.0`. What is the MOST crucial aspect of this command that you need to ensure is correctly configured?
The command itself is correct for pushing an image. However, the core requirement is ensuring the registry has enough storage space. Without sufficient capacity, the push operation will fail regardless of authentication or network connectivity. The other options are important considerations but secondary to verifying sufficient storage.
What does the "Container Registry Language" exercise practise?
Practice container registry vocabulary in English: image naming, digest vs tag, multi-platform manifests, registry authentication, and CVE scanning. 5 intermediate exercises.
How many questions are in this exercise?
This exercise has 20 questions, each multiple-choice with a full explanation shown after you answer.
What English level is this exercise for?
This exercise is tagged Intermediate. If the vocabulary feels difficult, browse the Containers & Virtualization category page for an easier module to start with.
Is this exercise free to use?
Yes. Every exercise on CoderSlingo, including this one, is free with no account, sign-up, or paywall.
Do I get feedback if I answer incorrectly?
Yes — whichever option you choose, right or wrong, you'll immediately see an explanation clarifying the correct term and why the other options don't fit.
Can I retry this exercise?
Yes — once you finish all the questions, a "Try again" button on the results screen resets the exercise so you can practise as many times as you like.
Do I need an account to track my progress?
No account is required. Your progress bar and score for this session are tracked in the browser as you go, but nothing is saved once you leave the page.
Is "Container Registry Language" part of a larger series?
Yes — it's one exercise in the Containers & Virtualization category on CoderSlingo. See the category page for the full list of related exercises on similar terminology.
Can I link directly to this exercise?
Yes — this exercise has its own permanent URL, so you can bookmark it or share the link directly with a colleague or study partner.
Where can I find more exercises like this one?
See the Containers & Virtualization category page for related exercises, or browse the main Exercises hub for other IT English topics.