Skip to main content
Root Image Catalog works with Docker out of the box. Images are pulled from cr.root.io using standard Docker commands and credentials.

Prerequisites

  • Docker 20.10 or later
  • Root registry credentials (username and token - see Authentication)

Authentication

Or pipe the token to avoid it appearing in shell history:
Docker stores credentials in ~/.docker/config.json. All subsequent pulls from cr.root.io use these credentials automatically. Credential helpers (optional): You can use any Docker-compatible credential helper (docker-credential-pass, macOS Keychain, etc.) for more secure credential storage. Configure them in ~/.docker/config.json as you would for any other registry.

Pulling Images

Tags mirror Docker Hub exactly. cr.root.io/python:3.12-slim is the same image as docker.io/python:3.12-slim - same behavior, same entrypoints, with CVEs remediated. Multi-architecture pulls:

Updating Your Dockerfile

Change the FROM directive to use cr.root.io:
No other changes are needed. The image behaves identically. Using a build argument for flexibility:
Multi-stage builds:

Docker Compose

Use cr.root.io images in docker-compose.yml the same way:
Docker Compose inherits credentials from ~/.docker/config.json, so no extra configuration is needed after running docker login.

Registry Mirror Configuration

To use cr.root.io as a registry mirror (so all pulls transparently go through Root), configure Docker’s daemon.json:
Restart Docker after making changes:
With mirror mode, docker pull python:3.12-slim automatically resolves to the Root-patched version without changing any Dockerfiles.

CI/CD with Docker

GitHub Actions:
GitLab CI:
CircleCI: