In a Docker Hub image name, library is the namespace that holds Docker Official Images. A short name such as alpine expands to docker.io/library/alpine. Community and publisher images carry their own organisation or user name in that position, so a name with a slash before the image is not an official image.
Reading an image reference
A full reference has up to four parts: a registry host, a namespace, a repository name, and a tag or digest.
| Reference | Registry | Namespace | Repository |
|---|---|---|---|
| alpine | docker.io | library | alpine |
| docker.io/library/alpine | docker.io | library | alpine |
| someuser/alpine | docker.io | someuser | alpine |
| registry.example.com/team/app | registry.example.com | team | app |
The Podman documentation gives the same example: alpine becomes docker.io/library/alpine. Kubernetes documents its own comparison, with busybox reading as docker.io/library/busybox:latest when no registry or tag is written.
Why this matters for trust
The namespace is a quick signal. An image under library comes from the curated official set. An image under someuser/alpine comes from whoever owns that account, and Docker's own documentation separates community images from official and verified publisher ones.
Lookalike names are a real tactic. A name that differs from an official one by one character, or that adds an extra word, sits in a different namespace and has no link to the official image. When you copy an image name from a tutorial or a chat answer, read the namespace before you read the repository.
Three habits that remove the guesswork
- Write the full reference in build files and manifests. Short names depend on defaults you did not set, and defaults can differ between tools.
- Check the namespace against the badge. If you expect an official image and the name has a slash before the repository, stop and look again.
- Pin the digest after you have decided the name is right. The name picks the repository, the digest picks the exact content.
When the registry is missing
If you leave out the registry host, the tool fills it in. Kubernetes states that with no registry hostname it assumes the Docker public registry, and that the default can be changed in the container runtime configuration. Podman uses its own unqualified search registries configuration. That is why one short name can resolve differently on two machines. Writing the host removes the ambiguity.
What a namespace does not tell you
It does not tell you the image is safe, current or free of findings. An official image can have a vulnerable package, and a community image can be carefully maintained. Use the namespace to decide how much extra checking to do, then do it: read the Dockerfile or source link, check the last update, and scan the digest.
Quick check
Is every short image name an official image?
A short name with no slash expands to the library namespace on Docker Hub in Docker and Podman, which is where official images live. Confirm on the Hub page.
Is someuser/alpine an official Alpine image?
No. The namespace is someuser, so it belongs to that account, not to the official set.
Safeguard scans the images you pull, records an SBOM per image, and can enforce policies on which sources are allowed. Try a free scan at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
