Private Docker registry compared: Docker Hub, GHCR, ECR

Every registry here speaks the same protocol, so docker push and docker pull work against all four. The differences are in the plan, the credentials and what happens after the push lands.

Side by side

	Docker Hub	GitHub Container Registry	Amazon ECR	Subnomic
Private repositories, free	One, on the Personal plan	Any number; container storage and bandwidth are currently free	500 MB of private storage a month for one year, for new AWS customers	Any number, on every plan; images do not count toward the plan's stored bytes
Pulls	Rate-limited, lower without signing in	Public images can be pulled anonymously	Free within the same AWS Region	Every pull needs a token; no anonymous pulls
A token for CI	Personal access tokens can be read-only but cover every repository the account can reach; organization access tokens can be scoped per repository	Classic personal access tokens with `read:packages`, `write:packages`, `delete:packages`, not limited to one package; `GITHUB_TOKEN` inside Actions	IAM policies, which can name a single repository	Robot accounts: pull, push or delete, on one repository or the whole workspace, with an optional expiry
Vulnerability scanning	Docker Scout on a limited number of repositories per plan	Not documented for the registry itself	Basic scanning at no additional cost, once per image per 24 hours; enhanced scanning billed by Amazon Inspector	Trivy on every push to a tag, with the fixed-in version for each finding, on every plan
Signing	Docker Content Trust is being retired; Notary v1 shuts down on 8 December 2026	Build provenance attestations from GitHub Actions	AWS Signer, managed or client-side	cosign signatures recognised; sign with the workspace key or your own KMS
OCI referrers	OCI artifacts supported	OCI images supported	Referrers API (OCI 1.1)	Not supported yet

When each one fits

Docker Hub is where public images live, and the place to publish one. For private images, the Personal plan has one repository; Docker Pro adds unlimited private repositories.
GitHub Container Registry fits a team whose code and CI are already on GitHub: packages inherit repository permissions, and GITHUB_TOKEN pushes from Actions without a stored secret. GitHub says container storage is free currently and promises a month's notice before that changes.
Amazon ECR fits workloads that run on AWS: IAM is the access control, pulls inside the Region cost nothing, and it supports the referrers API for signatures and SBOMs.
Subnomic fits a team that wants private repositories and scanning without a cloud account: robots scoped to one repository for CI, a scan with the fixing version on every push, and the registry in the same workspace as its sites, storage and servers.

What Subnomic's registry does not do

So you can weigh it: it has no anonymous pulls, so it is not a place to publish public images; tags are not immutable, so deploy by digest; it has no referrers API, so artifacts pushed only by digest are removed by garbage collection; and it has no pull-through cache or replication. Scanning and signing report; nothing refuses a push or pull because of them, so enforcement belongs in your pipeline or admission controller.

Moving a CI job over

Create a robot with push on one repository, store its secret in CI, and change the image name. The GitHub Actions setup has the full workflow, and when docker push or pull fails explains each error. What comes with the registry is on the Registry page, and the Free plan's limits on Free plan.

Sources

What this page says about other products is taken from their own pages, read on 12 November 2026. Plans and limits change; if one of these has, tell us and we will correct it.

A private container registry: Docker Hub, GHCR, Amazon ECR and Subnomic

Side by side

When each one fits

What Subnomic's registry does not do

Moving a CI job over

Sources

Push your first private image.