Docker Hub is where most tutorials tell you to push your images, and it is also where many small projects first hit a wall. The free tier limits unauthenticated pulls to 100 per six hours per IP address, and authenticated free accounts to 200 pulls per six hours. A busy CI pipeline, a shared office IP, or a Kubernetes cluster that restarts often can burn through that allowance before lunch, and the error message does not say rate limit in a way that makes the cause obvious.

GitHub Container Registry, or GHCR, is the free alternative most developers should know about. Public images are free to store and pull without the rate limits that bite on Docker Hub, and private images are free up to 500 MB of storage on the free GitHub plan, with additional storage billed per gigabyte. Authentication uses a GitHub personal access token, which integrates naturally with GitHub Actions, so a pipeline that builds and pushes in the same workflow needs no extra credentials or configuration.

The migration itself is straightforward. Retag each image from docker.io/yourname/app to ghcr.io/yourname/app, push it to GHCR, and update the image reference in your Compose files, Kubernetes manifests, and CI configuration. Keep the Docker Hub copy for a transition period, because old deploys and cached references will still point there. The most commonly missed step is the pull secret: private GHCR images need a Kubernetes imagePullSecret or a Docker login on the host, and a deploy that worked publicly will fail silently when the image goes private.

Two other free registries deserve a mention. Quay.io offers free public repositories with generous limits and is the registry behind much of the Red Hat ecosystem. Cloudflare's container registry is newer and pairs with its Workers platform. Neither replaces GHCR for a GitHub-centered workflow, but both are useful if you want a second registry as a backup or if your organization already uses their platforms.

The deeper lesson is about dependency on a single free service. Docker Hub's limits changed once and will change again, and every project that hardcodes docker.io as its only registry inherits that risk. A resilient setup pulls from a registry you control or from a provider whose free tier matches your actual pull volume, caches images on your own hosts where possible, and keeps the registry address in one configuration value so changing it takes minutes instead of a day.

For a new project, the default should be GHCR: free, unlimited public pulls, and already connected to the CI most developers use. Keep Docker Hub for images that need its ecosystem, such as official images and community images you do not maintain. The goal is not to abandon Docker Hub. It is to stop letting one provider's rate limit decide whether your deploy works today.

Image size is the quiet multiplier on registry costs and pull times. A Node.js image built on a full Debian base can be 900 MB, while the same app on an Alpine base is often under 150 MB. Smaller images pull faster, use less registry storage, and hit rate limits less often, because every pull moves fewer bytes. Use multi-stage builds to keep build tools out of the final image, and scan the result for known vulnerabilities before pushing. A registry migration is the perfect moment to slim the images down, because you are already retagging everything.