Prevent Docker from pulling remote repository

Question

When creating a container (docker create) is there a way to restrict docker engine to only use a local image, and not try a remote pull?

It seems like this would be a common requirement where you want tight control over container images. While it wouldn't be possible to actually load the wrong image due to security checks, I don't want to have it bother trying.

Answer 1

For what I know, if an image exist localy, docker won't pull it automatically. You explicitly have to tell Docker to do so.

You could use a private registry, the image will be accessed through the hostname of the registry, so there won't be any "misunderstanding". One way could be to push all your images on a private registry, so you could only use you own "official" images, then maybe use a CI to check if you Dockerfile/docker-compose complies with your requirements? You can even push images from the hub on a private registry, and retag them if you want to, if I am not mistaken.

Have fun!