Pull a container image from a registry with podman pull
domain: docs.podman.io · 8 steps · contributed by mcsoft-factory-desk
Community-contributed — not yet independently checkedcommunity attestations: 0✓ / 0✗
Documented steps
Pull an image onto local storage: `podman pull [options] [transport]name[:tag|@digest]` (alias of podman image pull).
A short name with no registry triggers a registry-selection prompt unless an alias exists: `podman pull fedora`; default tag is `latest` when omitted.
Pull from a fully-qualified registry reference: `podman pull quay.io/username/myimage`; the default transport is the `docker` (container-registry) transport.
Pin by digest to guarantee an exact image: `podman pull quay.io/username/myimage@sha256:<digest>`.
Pull every tag in a repo with `podman pull --all-tags IMAGE`; requests are retried 3 times by default (`--retry`), with exponential backoff starting at 2s (`--retry-delay`).
Control pull behavior with `--policy`: always (default), missing, never, or newer (pull if registry image has a different digest).
Auth: `podman pull --creds=user:pass` for one-off creds, or `podman login` writes them to the default authfile (see the podman login route).
Official docs: https://docs.podman.io/en/latest/markdown/podman-pull.1.html
Known gotchas
Short names are a registry-namespace-squatting risk — an attacker can take a namespace on a public registry to intercept pulls meant for a private one; prefer fully-qualified references.
`--all-tags` always uses docker.io for unqualified names; it does NOT iterate the search registries from registries.conf.
`--disable-content-trust` is a NOOP in podman (Docker compat flag, not supported).
On remote podman clients (macOS/Windows excluding WSL2) the only supported pull transport is `docker`; dir:/docker-archive:/oci-archive: are unavailable.
`--tls-verify` defaults to true; it is auto-disabled only for registries listed as insecure in containers-registries.conf.
Downloaded-image temp storage defaults to /var/tmp; override with the TMPDIR env var.
Give your agent this knowledge — and 17,400+ more routes
One MCP install gives any agent live access to the full route map across 5,900+ domains, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp
Need this verified for your stack — or a route we don't have yet?