# Connect to a public registry through the proxy registry

This topic describes how to pull images from public registries using the Replicated proxy registry.

For more information about the Replicated proxy registry, see [About the Replicated Proxy Registry](private-images-about).

## Pull public images through the Replicated proxy registry

You can use the Replicated proxy registry to pull both public and private images. Using the Replicated proxy registry for public images can simplify network access requirements for your customers, as they only need to whitelist a single domain (either `proxy.replicated.com` or your custom domain) instead of multiple registry domains. These are authenticated requests to avoid the proxy from hitting rate limits and preventing pulls. For more information about how to reference these in your values, see [Use the Proxy Registry with Helm CLI Installations](/vendor/helm-image-registry).

> [!IMPORTANT]  
> For public images, you need to first configure registry credentials.

To pull public images through the Replicated proxy registry, use the following `docker` commands:

```bash
docker login REPLICATED_PROXY_DOMAIN  -u you@example.com -p $SERVICE_ACCOUNT_TOKEN
docker pull REPLICATED_PROXY_DOMAIN/proxy/APPSLUG/UPSTREAM_REGISTRY_HOSTNAME/IMAGE:TAG
```
Where:
* `APPSLUG` is your Replicated app slug found on the [app settings page](https://vendor.replicated.com/settings).
* `REPLICATED_PROXY_DOMAIN` is `proxy.replicated.com` or your custom domain. For information about how to set a custom domain for the proxy registry, see [Use Custom Domains](/vendor/custom-domains-using). 
* `UPSTREAM_REGISTRY_HOSTNAME` is the hostname for the public registry where the image is located. If the image is located in a namespace within the registry, include the namespace after the hostname. For example, `quay.io/namespace`.
* `IMAGE` is the image name.
* `TAG` is the image tag.

## Examples

This section includes examples of pulling public images through the Replicated proxy registry.

### Pull images from dockerhub

The following examples show how to pull public images from DockerHub:

```bash
# Dockerhub is the default when no hostname is specified
docker pull proxy.replicated.com/proxy/APPSLUG/busybox
docker pull proxy.replicated.com/proxy/APPSLUG/nginx:1.16.0
```
```bash
# You can also optionally specify docker.io
docker pull proxy.replicated.com/proxy/APPSLUG/docker.io/replicated/replicated-sdk:1.0.0
```

### Pull images from other registries

The following example shows how to pull images from the Amazon ECR Public Gallery:

```bash
docker pull proxy.replicated.com/proxy/APPSLUG/public.ecr.aws/nginx/nginx:latest
```

### Pull images using a custom domain for the proxy registry

The following example shows how to pull a public image when a custom domain is configured for the proxy registry:

```bash
docker pull my.customdomain.io/proxy/APPSLUG/public.ecr.aws/nginx/nginx:latest
```
For information about how to set a custom domain for the proxy registry, see [Use Custom Domains](/vendor/custom-domains-using). 

## Related topic

[Connecting to an External Registry](packaging-private-images)