I am working in a highly restricted network environment where I cannot access Docker Hub or a private registry. Is there a way to copy a locally built Docker image from my development machine directly to a production host? I need to know the specific commands for packaging the image and the best method to transfer it while preserving all the layer metadata and tags.
3 answers
The most standard approach for this is using the docker save and docker load commands. On your source machine, you run docker save -o myimage.tar myimage:tag, which bundles the image layers and metadata into a single tar archive. You then move this file to the target host using a tool like scp or rsync. Once the file is on the destination host, you execute docker load -i myimage.tar to restore it to the local Docker engine. This method is highly reliable for air-gapped systems because it ensures the image on the destination is an exact bit-for-bit copy of the original, preserving the same Image ID and layer history without needing any external connectivity.
If I want to avoid creating a large intermediate tar file on my disk, is there a way to pipe the output of the save command directly over SSH to the destination host's Docker daemon?
For regular transfers, you might look into the docker-push-ssh utility. It automates the SSH tunnel and only pushes the layers that are missing on the target, making it much faster.
I agree with Jennifer; docker-push-ssh is great because it mimics the efficiency of a registry by using layer deduplication, which is a massive time-saver compared to a full docker save.
Yes, you can skip the file creation by using a pipe: docker save myimage:tag | ssh user@remote-host "docker load". This streams the data directly across the network. If you're on a slower connection, I highly recommend adding compression into the pipeline, like docker save myimage | gzip | ssh user@remote-host "gunzip | docker load", to reduce the amount of data being sent.