Stay organized with collections
Save and categorize content based on your preferences.
Pull an image from a Harbor project in the Docker client to download the
specified container image from your Harbor registry to your local machine. This
lets you run the containerized application locally or use it as a base
image for building other images.
Before you begin
To pull an image with Docker, you must have access to the following:
The necessary identity and access role. Ask your Organization IAM Admin to
grant you the Harbor Instance Viewer (harbor-instance-viewer) role.
INSTANCE_URL: the URL of the Harbor instance. For example,
harbor-1.org-1.zone1.google.gdc.test. You can get the URL of the Harbor
instance using the
GDC console or gdcloud CLI.
HARBOR_PROJECT_NAME: the name of the Harbor project. For example,
my-project.
IMAGE: the image's name. For example, nginx.
TAG: the tag for the image version that you want to pull. For example,
staging.
IMAGE_DIGEST: the sha256 hash value of the image contents. Each version
of an image has a unique image digest. In the Harbor instance UI, click the
specific image to see its digest. For more information, see
View Harbor registry instances.
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-08-29 UTC."],[[["\u003cp\u003ePulling an image from a Harbor project in Docker downloads a specified container image from the Harbor registry to your local machine.\u003c/p\u003e\n"],["\u003cp\u003eYou must have the Harbor Instance Viewer role and a Limited Guest account in Harbor to pull images.\u003c/p\u003e\n"],["\u003cp\u003eEnsure you have an existing Harbor project and a container image within that project before attempting to pull it.\u003c/p\u003e\n"],["\u003cp\u003eUse the \u003ccode\u003edocker pull\u003c/code\u003e command, along with the correct instance URL, project name, image name, and tag or digest, to pull an image.\u003c/p\u003e\n"]]],[],null,["# Pull an image with Docker\n\nPull an image from a Harbor project in the Docker client to download the\nspecified container image from your Harbor registry to your local machine. This\nlets you run the containerized application locally or use it as a base\nimage for building other images.\n\nBefore you begin\n----------------\n\nTo pull an image with Docker, you must have access to the following:\n\n- The necessary identity and access role. Ask your Organization IAM Admin to grant you the Harbor Instance Viewer (`harbor-instance-viewer`) role.\n- An account with the `Limited Guest` role from Harbor's role-based access controls. For more information, see [Configure access for APIs and within a Harbor instance](/distributed-cloud/hosted/docs/latest/gdch/platform-application/pa-ao-operations/configure-access-control#configure-access-within-harbor-instance).\n- An existing Harbor project. For more information, see [Create Harbor projects](/distributed-cloud/hosted/docs/latest/gdch/platform-application/pa-ao-operations/create-harbor-projects).\n- An existing container image in the existing Harbor project.\n\nPull an image\n-------------\n\nFollow these steps to pull an image from a\nHarbor project in the Docker client:\n\n1. Make sure that you are [authenticated](/distributed-cloud/hosted/docs/latest/gdch/platform-application/pa-ao-operations/configure-docker-authentication) to the Harbor instance.\n2. Pull the image from a Harbor project:\n\n docker pull \u003cvar translate=\"no\"\u003eINSTANCE_URL\u003c/var\u003e/\u003cvar translate=\"no\"\u003eHARBOR_PROJECT_NAME\u003c/var\u003e/\u003cvar translate=\"no\"\u003eIMAGE\u003c/var\u003e:\u003cvar translate=\"no\"\u003eTAG\u003c/var\u003e\n\n or \n\n docker pull \u003cvar translate=\"no\"\u003eINSTANCE_URL\u003c/var\u003e/\u003cvar translate=\"no\"\u003eHARBOR_PROJECT_NAME\u003c/var\u003e/\u003cvar translate=\"no\"\u003eIMAGE\u003c/var\u003e@\u003cvar translate=\"no\"\u003eIMAGE_DIGEST\u003c/var\u003e\n\nReplace the following values:\n\n- \u003cvar translate=\"no\"\u003eINSTANCE_URL\u003c/var\u003e: the URL of the Harbor instance. For example, `harbor-1.org-1.zone1.google.gdc.test.` You can get the URL of the Harbor instance using the [GDC console or gdcloud CLI](/distributed-cloud/hosted/docs/latest/gdch/platform-application/pa-ao-operations/manage-harbor-instances#view-harbor-registry-instances).\n- \u003cvar translate=\"no\"\u003eHARBOR_PROJECT_NAME\u003c/var\u003e: the name of the Harbor project. For example, `my-project`.\n- \u003cvar translate=\"no\"\u003eIMAGE\u003c/var\u003e: the image's name. For example, `nginx`.\n- \u003cvar translate=\"no\"\u003eTAG\u003c/var\u003e: the tag for the image version that you want to pull. For example, `staging`.\n- \u003cvar translate=\"no\"\u003eIMAGE_DIGEST\u003c/var\u003e: the sha256 hash value of the image contents. Each version of an image has a unique image digest. In the Harbor instance UI, click the specific image to see its digest. For more information, see [View Harbor registry instances](/distributed-cloud/hosted/docs/latest/gdch/platform-application/pa-ao-operations/manage-harbor-instances#view-harbor-registry-instances)."]]
