Docker Hub

What Docker Hub actually is

Docker Hub is the default container image registry: launched in 2013 alongside the Docker project, it is where the base images most of the industry runs on live. Docker's own numbers put it at more than 15 million images, pulled more than 16 billion times per month by over 20 million IPs — a scale no other public registry matches. Within that, the Docker Official Images program is the part we actually care about: 181 curated repositories (postgres, alpine, nginx, redis, and the rest), maintained with upstream projects, rebuilt for security fixes, multi-architecture, and the closest thing the container world has to trusted defaults. We list Docker Hub in our container platforms category, and for most teams it is less a choice than a dependency.

The service is more than a pull endpoint. It is a registry (public and private repositories over the Docker Registry API), a build service (autobuilds from GitHub/Bitbucket, now branded Build Cloud), a discovery surface (search, verified publishers, Docker Official Images, Docker Hardened Images), and a security surface (Docker Scout vulnerability analysis, image signing via Notary). The critical distinction for buyers: Docker Hub the registry is the free-ish community infrastructure, while Docker the company monetizes per-seat subscriptions that bundle Hub with Docker Desktop, Scout, Testcontainers Cloud, and support.

Pricing: what you really pay

The published tiers (docker.com/pricing): Docker Personal is $0 for one user — unlimited public repositories, one private repository, one Docker Scout-enabled repo, and pull-rate-limited access. Docker Pro is $11 per user per month billed monthly or $9 billed annually, and its main practical gift is unlimited Docker Hub pull rate (fair use), plus unlimited private repos, 2 Scout-enabled repos, 100 Testcontainers Cloud runtime minutes, and a 5-business-day support response. Docker Team is $16 monthly or $15 annually per user, up to 100 users: role-based access control on Hub, audit logs, unlimited Scout repos, unlimited private repos, 500 Testcontainers Cloud minutes, 10 organization access tokens, 2-business-day support with 24x5 availability. Docker Business is $24 per user per month (same price monthly or annually): SSO, SCIM provisioning, Image and Registry Access Management, Enhanced Container Isolation, 1,500 runtime minutes, 100 org tokens, unlimited organizations, 1-business-day support. Separately, Docker Hardened Images — curated near-zero-CVE images with SBOMs and SLSA provenance — are free at the Community tier, starting at $5k/repo for the Select tier with SLA-backed patching, and quote-based Enterprise.

The 2026 price list is the result of increases that hit existing customers on renewal: Pro went from $5 to $9 annually (80%), Team from $9 to $15 (67%). Docker also trimmed the free tier (private repos capped at one with 2 GB storage, one Scout-enabled repo down from three) and abandoned the consumption-based pull billing it had floated for 2025 after community pushback — paid tiers instead got unlimited pulls under a fair-use policy.

Where the real bill lands is the per-seat model. A ten-person team on Team pays $150 per month — $1,800 a year — largely to make a rate limit disappear, since the free tiers are throttled by pull rate and paid tiers are not. For CI-heavy organizations this math is the whole buying decision, and it is why self-hosted Harbor (free licensing, own nodes) and GitHub Container Registry show up as the cost-comparison baseline. Our view: if your usage is one developer and moderate CI, Personal plus a mirror is enough; if you are billing a department, price the seats against a self-hosted registry before you sign.

Performance & infrastructure

As a pull endpoint, Docker Hub is fast and effectively everywhere — a global CDN fronts the image layers, and the practical performance characteristic teams notice is not throughput but availability and rate limits. The official usage table (docs.docker.com) states the limits plainly: unauthenticated pulls are 100 per 6 hours per IPv4 address or IPv6 /64 subnet; authenticated Personal accounts get 200 per 6 hours; Pro, Team, and Business get unlimited pulls subject to fair use. Docker's pricing page markets Personal as '100 pulls/hr' — a burst reading that conflicts with the docs' 200-per-6-hours sustained figure; treat the docs table as the contract. A separate abuse rate limit in the order of thousands of requests per minute applies to all Hub properties for all users regardless of plan, returning a bare 429.

Those limits are the design of the business, and in practice they are what breaks pipelines: shared CI runners (GitHub Actions, GitLab) pull from shared IPs, hit the wall, and return 429s mid-build. The mitigations are known and boring: authenticate your pulls (doubling the free allowance), run a pull-through mirror, or pay for a seat.

Reliability and trust have real history behind them. Docker Hub is the backbone of container distribution and has had its share of outages, plus a genuine security incident: a breach of a single Hub database, detected 25 April (2019), exposed usernames and password hashes for roughly 190,000 accounts — about 5% of the user base — along with GitHub and Bitbucket tokens for autobuilds. Docker revoked the tokens, forced password resets, and stated that no Official Images were compromised (they carry GPG-signed commits and Notary signing). The response was reasonable and the curation protections held, but anyone distributing through Hub should assume supply-chain risk and verify provenance regardless. On the compliance side, SOC 2 Type 2 attestation for Docker Hub and Scout and ISO 27001 certification are listed for paid tiers, with third-party penetration tests and a security reporting address.

Where it falls short

The rate-limit structure is the defining weakness for automation. Free pull allowances are per-IP on a shared-IP internet, which means CI reliability on free tiers is a coin flip; the fix is per-seat pricing that scales with headcount rather than consumption, which overprices light users and underprices heavy ones. The 2026 increases (80% on Pro, 67% on Team) landed on top of that structure, and Docker's February 2025 retreat from metered billing tells you the company knows how sensitive this is.

Second, private repository features at the free tier are minimal (one repo, 2 GB storage), autobuilds are effectively a paid workflow, and the interesting security tooling — Scout policy enforcement, Image and Registry Access Management, hardened Desktop — is tiered up to Business. Small teams regularly discover that the feature they assumed was standard is two tiers away.

Third, availability transparency. Docker publishes no uptime SLA for Hub itself; the published SLAs are support response times (5/2/1 business days by tier). For a registry sitting in the critical path of every deployment, a contractual uptime number with credits is something competitors and self-hosted alternatives can be evaluated on — and Docker simply does not offer one.

Fourth, strategic concentration. The entire industry pulling base images from one commercial service is a single point of failure and trust; the 2019 breach showed what that concentrates. Mirroring Official Images and pinning digests are standard hygiene, and we treat them as mandatory rather than optional.

Who should pick this

We'd pick Docker Hub as the source of base images and verified publisher content for essentially everyone — that is what it is for, and the Official Images curation earns the trust. Paid seats make sense when you want unlimited pulls without mirror infrastructure, private repositories with RBAC (Team), or SSO and registry access management (Business). Individual developers get genuine value from Personal and Pro: unlimited private repos on Pro for $9 a month annual is cheaper than self-hosting anything.

We would not buy Team seats for a whole department without comparing against GHCR, ECR, or Harbor first — the per-seat math is the weakest part of the offer, and in CI-heavy shops a pull-through mirror does more per dollar than a seat. Organizations with compliance requirements will find the Business tier's controls and attestation evidence relevant, but should still sign their own images.

Key takeaways

• The container ecosystem's default registry since 2013: 15M+ images, 16B+ pulls/month across 20M+ IPs, and the curated Docker Official Images program (181 repositories) that most deployments build on.
• Free tiers exist and are real: Personal at $0 (unlimited public repos, 1 private repo), but pull limits bite — 100/6h unauthenticated, 200/6h authenticated Personal, unlimited on paid tiers (fair use).
• Paid pricing: Pro $9-11/user/month, Team $15-16/user/month (RBAC, audit logs, unlimited repos), Business $24/user/month (SSO, SCIM, registry access management) — after 2026 increases of 80% (Pro) and 67% (Team) over old rates.
• Per-seat pricing is the cost weak point for teams; compare against GitHub Container Registry, AWS ECR, or self-hosted Harbor before buying seats for a department.
• No published uptime SLA for Hub itself — only support response times (5/2/1 business days); paid tiers carry SOC 2 Type 2 and ISO 27001 attestations.
• Real incident history (2019 database breach, ~190k accounts; Official Images uncompromised) — pin digests, verify provenance, and mirror what you depend on.

Sources

• https://www.docker.com/pricing/
• https://docs.docker.com/docker-hub/usage/
• https://www.docker.com/blog/blog-red-hat-universal-base-image-hub-pulls-grow/
• https://hub.docker.com/u/library/
• https://forums.docker.com/t/future-updates-on-docker-hub-docker-cloud/20498
• https://bex.co/blog/2026/07/10/docker-hub-2026-price-hike-self-hosted-registry
• http://eden-cms-v2.onbex.co/blog/2026/07/31/docker-hub-price-hikes-self-hosted-harbor-registry
• https://runxbuild.com/blog/docker-pricing
• https://toolradar.com/tools/docker-hub/pricing
• https://githubactionscost.online/docker-hub-pull-rate-calculator
• https://securityweek.com/docker-hub-breach-hits-190000-accounts
• https://scworld.com/news/docker-hub-database-access-compromises-190000-accounts
• https://computing.co.uk/news/3074715/190-000-docker-hub-user-names-and-passwords-exposed-in-security-breach
• https://trendmicro.com/vinfo/de/security/news/cybercrime-and-digital-threats/docker-hub-repository-suffers-data-breach-190-000-users-potentially-affected