Skip to main content
Images in Root Image Catalog are pulled using standard container tooling. The registry URL is cr.root.io and tags mirror Docker Hub exactly.

​
Registry URL Structure

Root images follow this pattern: 
cr.root.io/{image}:{tag}
Examples:
Docker HubRoot Image Catalog
python:3.12-slimcr.root.io/python:3.12-slim
node:20-alpinecr.root.io/node:20-alpine
nginx:1.25cr.root.io/nginx:1.25
postgres:16cr.root.io/postgres:16
redis:7-alpinecr.root.io/redis:7-alpine
The only change is the registry prefix. Tags, entrypoints, environment variables, and behavior are identical to Docker Hub.

​
Tagging Conventions

Root Image Catalog preserves Docker Hub tag conventions exactly:
  • Version tags - python:3.12, node:20, nginx:1.25 - track the same upstream release
  • Variant tags - -slim, -alpine, -bookworm - same variant as Docker Hub
  • Major tags - python:3, node:20 - updated when the latest patch-level is updated
  • latest - tracks the current default upstream image
Tags are kept in sync with upstream. When new upstream versions are released, Root adds them to the catalog. When Root Patches are applied, the same tags are updated in place - your existing references continue to work.

​
Pulling with Docker

Authenticate first: 
echo "$ROOT_TOKEN" | docker login cr.root.io --username rootio --password-stdin
Pull an image: 
docker pull cr.root.io/python:3.12-slim
docker pull cr.root.io/node:20-alpine
docker pull cr.root.io/postgres:16-alpine
Pull a specific architecture: 
docker pull --platform linux/amd64 cr.root.io/python:3.12-slim
docker pull --platform linux/arm64 cr.root.io/python:3.12-slim
Specifying --platform is recommended when running the mirror script on macOS or ARM hosts to avoid pulling the wrong variant. Verify the pull: 
docker inspect cr.root.io/python:3.12-slim | grep -E '"RepoDigests|"Os|"Architecture'

​
Pulling with containerd / nerdctl

[nerdctl pull, containerd config for cr.root.io mirror coming soon]

​
Pulling in Kubernetes

See Kubernetes Integration for full setup. In brief: Create the ImagePullSecret: 
kubectl create secret docker-registry root-registry-credentials \
  --docker-server=cr.root.io \
  --docker-username=rootio \
  --docker-password=YOUR_ROOT_TOKEN
Reference in your Pod: 
spec:
  imagePullSecrets:
    - name: root-registry-credentials
  containers:
    - name: app
      image: cr.root.io/python:3.12-slim

​
Digest Pinning

For reproducible, immutable deployments, pin to a specific image digest instead of a tag: Get the digest: 
docker pull cr.root.io/python:3.12-slim
docker inspect --format='{{index .RepoDigests 0}}' cr.root.io/python:3.12-slim
# cr.root.io/python@sha256:abc123...
Pull by digest: 
docker pull cr.root.io/python@sha256:abc123...
Use in a Dockerfile: 
FROM cr.root.io/python@sha256:abc123...
Digest stability: When Root applies a patch to an image, the digest changes (the content changes). Tags always point to the latest patched version. If you pin to a digest, you remain on that exact version until you explicitly update the digest reference. For most workloads, tracking by tag is recommended - you automatically receive new Root Patches. Pin by digest only when you need to control exactly when updates are applied.