Pulling Images

Images in Root Image Catalog are pulled using standard container tooling. The registry URL is cr.root.io and tags mirror Docker Hub exactly.

Registry URL Structure

Root images follow this pattern:

cr.root.io/{image}:{tag}

Examples:

Docker Hub	Root Image Catalog
`python:3.12-slim`	`cr.root.io/python:3.12-slim`
`node:20-alpine`	`cr.root.io/node:20-alpine`
`nginx:1.25`	`cr.root.io/nginx:1.25`
`postgres:16`	`cr.root.io/postgres:16`
`redis:7-alpine`	`cr.root.io/redis:7-alpine`

The only change is the registry prefix. Tags, entrypoints, environment variables, and behavior are identical to Docker Hub.

Tagging Conventions

Root Image Catalog preserves Docker Hub tag conventions exactly:

Version tags - python:3.12, node:20, nginx:1.25 - track the same upstream release
Variant tags - -slim, -alpine, -bookworm - same variant as Docker Hub
Major tags - python:3, node:20 - updated when the latest patch-level is updated
latest - tracks the current default upstream image

Tags are kept in sync with upstream. When new upstream versions are released, Root adds them to the catalog. When Root Patches are applied, the same tags are updated in place - your existing references continue to work.

Pulling with Docker

Authenticate first:

echo "$ROOT_TOKEN" | docker login cr.root.io --username rootio --password-stdin

Pull an image:

docker pull cr.root.io/python:3.12-slim
docker pull cr.root.io/node:20-alpine
docker pull cr.root.io/postgres:16-alpine

Pull a specific architecture:

docker pull --platform linux/amd64 cr.root.io/python:3.12-slim
docker pull --platform linux/arm64 cr.root.io/python:3.12-slim

Specifying --platform is recommended when running the mirror script on macOS or ARM hosts to avoid pulling the wrong variant. Verify the pull:

docker inspect cr.root.io/python:3.12-slim | grep -E '"RepoDigests|"Os|"Architecture'

Pulling with containerd / nerdctl

[nerdctl pull, containerd config for cr.root.io mirror coming soon]

Pulling in Kubernetes

See Kubernetes Integration for full setup. In brief: Create the ImagePullSecret:

kubectl create secret docker-registry root-registry-credentials \
  --docker-server=cr.root.io \
  --docker-username=rootio \
  --docker-password=YOUR_ROOT_TOKEN

Reference in your Pod:

spec:
  imagePullSecrets:
    - name: root-registry-credentials
  containers:
    - name: app
      image: cr.root.io/python:3.12-slim

Digest Pinning

For reproducible, immutable deployments, pin to a specific image digest instead of a tag: Get the digest:

docker pull cr.root.io/python:3.12-slim
docker inspect --format='{{index .RepoDigests 0}}' cr.root.io/python:3.12-slim
# cr.root.io/python@sha256:abc123...

Pull by digest:

docker pull cr.root.io/python@sha256:abc123...

Use in a Dockerfile:

FROM cr.root.io/python@sha256:abc123...

Digest stability: When Root applies a patch to an image, the digest changes (the content changes). Tags always point to the latest patched version. If you pin to a digest, you remain on that exact version until you explicitly update the digest reference. For most workloads, tracking by tag is recommended - you automatically receive new Root Patches. Pin by digest only when you need to control exactly when updates are applied.

Getting Started

Root Image Catalog

Platform

Integrations

AI Integrations

Root Library Catalog

Core Concepts

Reports & Insights

Reference

Trust & Compliance

Pulling Images

Registry URL Structure

Tagging Conventions

Pulling with Docker

Pulling with containerd / nerdctl

Pulling in Kubernetes

Digest Pinning

​Registry URL Structure

​Tagging Conventions

​Pulling with Docker

​Pulling with containerd / nerdctl

​Pulling in Kubernetes

​Digest Pinning

Registry URL Structure

Tagging Conventions

Pulling with Docker

Pulling with containerd / nerdctl

Pulling in Kubernetes

Digest Pinning