Docker Hub on any website.

The Docker Hub v2 API at hub.docker.com/v2/ is the authoritative entry point for any Docker Hub widget worth embedding. It is a free, public REST endpoint that resolves any Docker Hub repository by namespace and name, returning a JSON document with the repo description, star count, pull count (the live cumulative pull figure Docker Hub itself displays), short description, full description with Markdown, last-updated timestamp, repository type (image, plugin), is_official boolean (the curated Docker Official Images program that includes nginx, postgres, redis, python, node, ubuntu, alpine, and roughly 160 other curated bases), is_automated boolean (legacy automated builds), and the OCI manifest reference. Tag listing happens at hub.docker.com/v2/repositories/{namespace}/{repo}/tags/, which returns a paginated list of every tag with last-pushed timestamps, total compressed size, and per-architecture image digests. The v2 API replaced the older v1 hub.docker.com/v1/repositories endpoint, which was deprecated in 2017 alongside the registry-v1 protocol. There is a separate Distribution Spec API at registry-1.docker.io that handles the actual layer fetching for docker pull, but a widget never needs to talk to it. Read operations on the v2 API need no authentication for public repos and are CORS-friendly when used with a User-Agent header. There is also a closely related but distinct endpoint, the Docker Scout API, which returns vulnerability scan results for images that have Docker Scout enabled (free for personal accounts and the first 3 repos, paid above that). Poper combines all three sources (Hub v2 metadata, v2 tag listing, Docker Scout vulnerability data) into a single normalized response so the widget renders repo metadata, tag history, multi-arch matrix, and CVE counts from one widget config.

Docker Inc. is the company that builds Docker Desktop, Docker Hub, and the open-source Docker Engine that ships in every Linux distribution. The current Docker Inc. is a pivoted version of the original company, because in November 2019 Docker sold its enterprise products business (Docker Enterprise Edition, the orchestrator stack, and the on-prem registry product Docker Trusted Registry) to Mirantis, the OpenStack and Kubernetes platform vendor. Mirantis renamed Docker Trusted Registry to Mirantis Secure Registry, the orchestrator became Mirantis Kubernetes Engine, and the on-prem container platform continues under the Mirantis brand for enterprise customers running Docker Swarm in production. The remaining Docker Inc. focused on developer tools, which is the Docker Hub, Docker Desktop, Docker Build Cloud, Docker Scout, and Docker Compose surfaces that web embeds actually interact with. This split matters for embedding because a Docker Hub widget only deals with hub.docker.com, which is run by the post-2019 Docker Inc., and the v2 API contract has remained stable across the split. Enterprise on-prem registries that run Mirantis Secure Registry expose the same Distribution Spec API but a different management API, and are out of scope for any widget that targets the public Docker Hub. The 2022 Docker subscription pricing change introduced paid tiers for organizations larger than 250 employees with revenue above $10M (the current Pro, Team, and Business tiers at $9, $15, and $24 per user per month) but did not change the public read API or restrict embedding of public repos. Anonymous read access to public repos remains free and unauthenticated. The widget never depends on a paid Docker subscription on the embedder's side.

In August 2020 Docker announced and in November 2020 enforced anonymous pull rate limits on Docker Hub: 100 pulls per 6 hours per IPv4 address for anonymous users and 200 pulls per 6 hours for free authenticated accounts. The change targeted automated CI usage that had grown faster than the registry could economically sustain, but it had a side effect on widgets and badges that fetch metadata from the visitor's browser. The Docker Hub v2 API has a separate but related limit: 200 read requests per 6 hours per IP for anonymous calls, and the rate-limiter response includes the standard ratelimit-limit and ratelimit-remaining headers so a widget can detect when it is being throttled. A naive widget that calls hub.docker.com/v2/repositories/{namespace}/{repo}/ from the visitor's browser will share rate-limit budget with every other anonymous user behind the same NAT or carrier-grade NAT, which means a busy embedded page on a popular site can hit the limit within minutes. The standard mitigation patterns are: pre-render pull counts at build time (which goes stale immediately), use authenticated API calls with a Personal Access Token (which couples the widget to the maintainer's PAT and burns the maintainer's higher 5000-per-6-hours quota for visitor traffic), or proxy through an edge cache that absorbs the rate limits as a single shared bucket per cache region. Poper uses the third pattern: every Hub v2 read passes through our global edge cache, and the visitor's browser only ever touches our CDN. Pull counts stay live, anonymous limits never apply, and the maintainer's PAT is never exposed in client code. If you are embedding Docker Hub data in any volume, this is the architecture that scales. The same 2020 changes also drove the rise of the GitHub Container Registry (ghcr.io), which Microsoft positioned as a no-rate-limit alternative for OSS maintainers tired of explaining Docker Hub limits to contributors. Many maintainers now mirror to both registries, and the widget can render Docker Hub primary plus a ghcr.io secondary badge for repos that publish to both.

Docker Scout, launched in 2023 as the successor to the discontinued Docker Hub Vulnerability Scanning powered by Snyk, is Docker's own native vulnerability scanner. Scout analyzes the OCI image manifest, walks every layer, identifies the operating-system base, the language runtime, every package added through apt, apk, yum, npm, pip, gem, cargo, or go install, and matches each package version against the National Vulnerability Database, GitHub Security Advisories, the Go vulnerability database, and the OSV.dev aggregator. Results are reported as Critical, High, Medium, Low, and Unspecified vulnerability counts per image and per layer, with reachability analysis for some language ecosystems that distinguishes vulnerabilities in code your image actually executes from vulnerabilities in transitive dependencies that are never reached. Scout is free for personal Docker accounts, free for the first 3 repositories on Pro and Team plans, and paid above that. From an embedding standpoint, this matters because security-aware buyers (financial services, healthcare, regulated industries, anyone subject to SOC 2 Type II audits, FedRAMP, or DORA) increasingly want to see live CVE counts before they pull a third-party image. A Docker Hub widget that surfaces Critical and High Scout counts next to the docker pull command turns vulnerability transparency into a sales asset for vendors of hardened, distroless, or CIS-benchmark images, and turns it into a credibility signal for OSS maintainers who fix CVEs faster than the average. Poper queries the Docker Scout API for any repo where Scout is enabled and renders the Critical, High, Medium, and Low counts as colored chips next to each tag. Repos without Scout enabled simply skip the chips, no error message, no confusing empty state. The widget also supports surfacing the Docker Verified Publisher and Docker Sponsored Open Source Program badges, which are the two trust badges Docker Inc. issues to vetted commercial vendors and to maintainers of widely-used OSS images respectively. These two badges, plus a clean Scout scan, are the closest the open registry world has to a green checkmark next to your image.

The default container-registry embeds that maintainers reach for first are surprisingly expensive on Lighthouse. The shields.io pull-count badge is a hosted SVG that ships fast but emits zero structured data and forces a hub.docker.com round trip on every request unless cached aggressively. The Docker Hub repo iframe (hub.docker.com/embed/) ships as a 280 to 420KB iframe with its own React bundle, its own CSS, and its own ad-script logic for Docker subscription upsells, and embedding three of them on one page can drop a Lighthouse score by 18 to 25 points before any other code runs. Embed five repos as iframes and you can lose half your Largest Contentful Paint budget. The fix is the lite-card pattern: render only the repo name, short description, pull count, star count, and a copy-to-clipboard install command (under 6KB per repo) on initial load, and only swap in heavier elements like the Dockerfile preview, layer breakdown, or multi-arch matrix when the visitor expands a card. Poper ships lite mode as the default, so the repos you embed cost you no more LCP than the same number of static text blocks. Visitors who expand a card see the full detail. Visitors who scroll past pay nothing. The performance difference between lite mode and full iframe embeds is the difference between a 92 Lighthouse score and a 67. There are three additional optimizations Poper applies on top of lite mode. First, repo logos are served from the Docker Hub CDN (production.cloudflare.docker.com) and re-encoded as WebP through our edge layer, which typically halves logo weight versus the original PNG. Second, the install-command copy button uses a single inline SVG instead of an icon font request, which saves a round trip per repo. Third, the pull-count number is rendered as plain text from the cached API response with no JavaScript animation by default, so the cumulative-layout-shift cost of pull-count animation (which can dominate CLS on slower mobile devices) is zero unless you opt into the optional sparkline chart. The combined result is that a page with twelve embedded Docker Hub repos in lite mode often outperforms a page with two embedded repos in iframe mode on every Core Web Vitals metric. If page speed matters to your SEO, this is the single biggest reason to choose carefully which Docker Hub widget you embed. GDPR consent is also handled cleanly: lite mode sets no cookies and makes no third-party network requests until the visitor clicks a copy button, so the widget passes the strictest EU consent rules without requiring a cookie banner click.