Instruction file imported from buegelbeatz/tsp-quantum (.github/instructions/container-expert/dockerhub.instructions.md). Copyright stays with the author.

Enterprise Specification: Docker Hub Registry Standard

1. Purpose

This document defines the enterprise standard for integrating with Docker Hub as an external container image registry.

The objective is to ensure:

• Controlled use of public and private repositories
• Secure image publication and consumption
• Clear ownership and namespace governance
• Reliable developer and CI/CD workflows

2. Scope

This specification applies to:

• Teams pulling images from Docker Hub
• Teams publishing approved images to Docker Hub
• CI/CD systems using Docker Hub credentials
• Local developer environments authenticating to Docker Hub

3. Registry Role

Docker Hub is an approved registry for:

• Consuming trusted public base images
• Publishing non-sensitive public images where approved
• Publishing private images where contractually and operationally suitable

4. Repository Governance

4.1 Namespace Standard

Repositories MUST be created under approved personal or organizational namespaces.

4.2 Visibility

Repository visibility MUST be explicitly defined as:

• Public
• Private

The chosen visibility MUST match data classification and release policy.

4.3 Ownership

Each repository MUST have:

• A defined owner
• A support contact
• A lifecycle and retention policy

5. Authentication and Access Control

• Access MUST use approved Docker Hub credentials or tokens
• CI/CD pipelines MUST use non-human credentials where possible
• Push access MUST be role-based
• Shared credentials MUST NOT be used

6. Image Publication Standard

6.1 Push Requirements

Published images MUST:

• Use explicit tags
• Include provenance metadata where required
• Be built from version-controlled source
• Be scanned according to enterprise policy where applicable

6.2 Tagging

Tags MUST follow enterprise versioning conventions.

The latest tag MAY exist for convenience but MUST NOT be the sole deployment reference for controlled environments.

7. Image Consumption Standard

• Public base images MUST be approved before organizational use
• Pulls SHOULD favor trusted publishers and curated bases
• Teams SHOULD pin image versions or digests for deterministic builds

8. Security Requirements

• Secrets MUST NOT be embedded in images
• Sensitive internal workloads SHOULD NOT default to public Docker Hub repositories
• Mirroring or caching MAY be required by enterprise platform policy

9. Operational Requirements

• Repository cleanup and retention SHOULD be defined
• Deprecated tags SHOULD be documented or removed
• Pull-rate and availability considerations MUST be addressed for critical workflows

10. Governance

Registry usage is owned by platform engineering and security governance.

Exceptions MUST be documented and approved.

11. Summary

This standard ensures secure and governed use of Docker Hub for enterprise image publishing and consumption.