Docker Image Name Parser & Formatter
Parse, decompose, and format OCI and Docker image references into canonical registry, namespace, and tag components — entirely on this device.
Do it offline:$
How to use it
- Enter any Docker image string (e.g. nginx, ghcr.io/org/app:v1, or a digest pointer).
- Inspect the fully-qualified canonical reference (e.g. converting short nginx to docker.io/library/nginx:latest).
- View the decomposed breakdown: Registry Host, Organization/Namespace, Repository Name, and Tag.
- Copy the normalized reference or generated docker pull command directly.
Parse, decompose, and format Docker and OCI container image references into canonical registry hosts, namespaces, repository names, tags, and sha256 digests.
How it works
Container image references conform to the Open Container Initiative (OCI) image distribution specification.
When no registry host is specified (such as 'ubuntu' or 'node:18'), Docker clients implicitly prefix the reference with 'docker.io/library/'.
When a host port is included (e.g. 'localhost:5000/app:tag'), the parser recognizes the domain and port rather than confusing it with a repository namespace.
Pinning images by cryptographic digest (@sha256:...) guarantees absolute immutability, preventing tag mutation security risks in production deployments.
Examples
Every example on this page is executed against the same engine that powers the tool, on every build.
Gotchas worth knowing
Common errors
FAQ
Why does 'nginx' expand to 'docker.io/library/nginx:latest'?
Docker CLI shortcuts treat single-word images as official Docker Hub library images. The full canonical reference always resolves to docker.io as the registry and 'library' as the root organization.
Why should production Kubernetes manifests pin image digests?
Tags are mutable! A tag like ':latest' or even ':v1.2.0' can be overwritten by another push to the registry. Specifying a sha256 digest guarantees that every node pulls the exact same byte-for-byte image binary.
How does the parser distinguish a private registry port from a tag?
Colons appearing before the first slash (e.g. 'myregistry.com:5000/repo') represent the registry hostname's network port, whereas a colon appearing after the last slash represents the image tag.