Registries store and distribute images. Docker Hub is the public default registry; you pull images from it without specifying a registry hostname. Push with docker push and pull with docker pull. Private registries require authentication via docker login.

$ docker pull ubuntu               # pull from Docker Hub (default)
$ docker push myrepo/myapp:1.0     # push to Docker Hub
$ docker login myregistry.com      # authenticate to a private registry
$ docker pull myregistry.com/myapp # pull from private registry
$ docker logout                    # logout from a registry

A registry URL follows the format <hostname>/<namespace>/<repository>:<tag>. Images must be tagged with the registry hostname before pushing to a private registry. Docker Hub images can omit the hostname (e.g., ubuntu:latest is shorthand for docker.io/library/ubuntu:latest). Private registries require valid credentials stored locally after docker login.