AWS ECR vs Docker Hub vs GitHub Container Registry: Which One Should You Use?

Choosing a container registry feels like a minor decision until you hit Docker Hub's pull rate limits at 3 AM during a production incident, or get surprised by an ECR data transfer bill.

I've used all three extensively. Here's a practical comparison that focuses on what actually matters day-to-day.

The Three Options at a Glance

AWS ECR (Elastic Container Registry) — AWS's native registry. Deep integration with EKS, ECS, CodePipeline. Private by default. Pay per GB stored and transferred.

Docker Hub — The original public registry. Every Docker image you've ever pulled from the internet lived here. Has a generous free tier for public images, rate limits for anonymous and free users on private pulls.

GitHub Container Registry (GHCR) — GitHub's registry, tightly integrated with GitHub Actions. Free for public images, included in GitHub Team/Enterprise plans for private images.

Pull Rate Limits: Docker Hub's Big Problem

This is the most practically important difference and the one that has bitten the most teams.

Docker Hub limits unauthenticated pulls to 100 pulls per 6 hours per IP. For authenticated free accounts, it's 200 pulls per 6 hours. For CI/CD systems running in shared environments (GitHub Actions, GitLab CI), you're sharing that IP with thousands of other users, so you hit the limit constantly.

ECR has no pull rate limits. If you're pulling from ECR to EKS on AWS, it's all within AWS's network and there's no throttling.

GHCR has no documented pull rate limits for authenticated pulls. Public images are freely pullable without limits.

If you've been hitting Docker Hub rate limits in your CI/CD pipeline, this alone is reason to migrate.

Cost Comparison

Docker Hub:

• Free: 1 private repo, unlimited public repos, 200 pulls/6h
• Pro: $9/month — unlimited private repos, higher pull limits
• Team: $7/user/month

AWS ECR:

• $0.10/GB/month storage
• Data transfer out to internet: $0.09/GB
• Data transfer to EC2/EKS in same region: free
• Free tier: 500MB/month for 12 months

For a team deploying to EKS: if your images stay within AWS (ECR → EKS in same region), transfer is free. You only pay storage — typically a few dollars per month for most teams.

The hidden cost: if you're pulling ECR images outside AWS (local development, external CI), you pay data transfer fees. This adds up if your team is pulling large images frequently.

GHCR:

• Free for public packages
• Included in GitHub plans for private packages (GitHub Free: 500MB storage, 1GB transfer/month; Team: 2GB storage, 10GB transfer/month)
• Overage: $0.008/GB storage, $0.50/GB data transfer

For teams already on GitHub Team/Enterprise, GHCR is effectively free for most workloads.

Security and Access Control

ECR wins here for AWS-native deployments.

ECR integrates directly with IAM. Your EKS pods can pull images without any stored credentials — they use IAM roles via IRSA (IAM Roles for Service Accounts). No secrets to rotate, no credential leaks in CI/CD logs.

# EKS nodes pull from ECR automatically with the right IAM policy
aws ecr get-login-password --region us-east-1 | \
  docker login --username AWS --password-stdin \
  123456789.dkr.ecr.us-east-1.amazonaws.com

ECR also supports:

• Image vulnerability scanning (powered by Snyk/Clair)
• Lifecycle policies to automatically delete old images
• Repository policies for cross-account access
• Immutable image tags (prevents tag overwriting in production)

GHCR uses GitHub tokens and fine-grained PATs. Good integration with GitHub Actions — you authenticate with GITHUB_TOKEN automatically in workflows.

Docker Hub requires stored credentials in CI/CD. Not ideal for security-conscious teams.

CI/CD Integration

GHCR is the easiest if you're on GitHub Actions:

- name: Log in to GitHub Container Registry
  uses: docker/login-action@v3
  with:
    registry: ghcr.io
    username: ${{ github.actor }}
    password: ${{ secrets.GITHUB_TOKEN }}
 
- name: Build and push
  uses: docker/build-push-action@v5
  with:
    push: true
    tags: ghcr.io/${{ github.repository }}:${{ github.sha }}

No additional secrets needed. GITHUB_TOKEN is automatic.

ECR in GitHub Actions requires AWS credentials:

- name: Configure AWS credentials
  uses: aws-actions/configure-aws-credentials@v4
  with:
    role-to-assume: arn:aws:iam::123456789:role/github-actions-ecr
    aws-region: us-east-1
 
- name: Login to Amazon ECR
  id: login-ecr
  uses: aws-actions/amazon-ecr-login@v2
 
- name: Build and push
  uses: docker/build-push-action@v5
  with:
    push: true
    tags: ${{ steps.login-ecr.outputs.registry }}/myapp:${{ github.sha }}

More setup, but once configured it works smoothly.

When to Use Each

Use AWS ECR when:

• You're deploying to EKS or ECS — same-region pulls are free and fast
• You need IAM-based access control without stored credentials
• Compliance requires image scanning and audit logs
• You're already heavily invested in the AWS ecosystem

Use GHCR when:

• Your code is on GitHub and you use GitHub Actions
• You want zero-configuration CI/CD (no extra secrets needed)
• You need free private registries without paying for ECR or Docker Hub
• You're running open source projects that need public image hosting

Use Docker Hub when:

• You're distributing public images that people pull directly (official images, open source projects)
• Your team uses a mix of cloud providers and wants a neutral registry
• You need the ecosystem — Docker Hub's public image index is unmatched

The Setup I'd Recommend for Most Teams

If you're on AWS and deploying to EKS: ECR for production images, GHCR or ECR for CI artifacts. The IAM integration and same-region free transfer make ECR the right choice for production.

If you're on GitHub Actions and not AWS-native: GHCR. It's free, well-integrated, and has no pull rate limits. There's very little reason to pay for Docker Hub Pro when GHCR does the same job at no cost.

If you're distributing images publicly: Docker Hub for discoverability (it's where people look), mirrored to GHCR or ECR for availability.

The one thing I'd strongly recommend regardless of which registry you choose: stop using latest as your production image tag. Use commit SHA or semantic version tags. With ECR, enable immutable tags to enforce this automatically.

Setting up your container infrastructure? Check out our Docker security best practices guide and GitHub Actions CI/CD pipeline tutorial.