The default public registry where Docker images are stored, versioned, and pulled from.
Docker Hub is a registry — a place to push and pull images, identified by a name:tag combination. Not every image on it carries the same trust level: official images are maintained directly by Docker, verified publisher images come from vetted organizations, and community images can be pushed by anyone, with correspondingly different levels of scrutiny worth being aware of before pulling one into a production build.
Docker Hub is one implementation of the registry concept, not the only one — private registries like Amazon ECR, Google GCR, or a self-hosted registry all implement the same underlying registry API. Pulling by digest rather than by tag matters for build reproducibility specifically because a tag can be reassigned to point at a different image later — even latest, or a seemingly fixed version tag, isn't actually guaranteed to stay pointed at the same bytes over time.
What you'll walk away knowing