Remove Docker Registry Credentials with docker logout

A pipeline that still pulls with a token you thought was gone usually means docker logout ran against the wrong user, not that the command failed.

You will remove Docker CLI credentials for Docker Hub or a named registry, then check that the right entry is actually gone. Allow about five minutes. The command changes local authentication state only: it does not stop containers, remove images, or revoke a token at the registry itself.

Before you start

1. Identify the Docker CLI and configuration context

Check the executable and version before changing anything. This catches the common trap where a shell finds a different Docker installation than the one you meant:

$ command -v docker
/usr/bin/docker
$ docker --version
Docker version 29.8.1, build 4a63305
$ printf 'Docker config: %s\n' "${DOCKER_CONFIG:-$HOME/.docker}"

DOCKER_CONFIG, when set, points at another configuration directory. Otherwise Linux Docker CLI configuration normally lives under $HOME/.docker. A credential store or helper can keep the secret outside config.json entirely, so that file alone is not a complete inventory.

Checkpoint: confirm the printed executable, version and configuration directory belong to the user and environment whose credentials you actually want to change.

2. Choose the exact registry server

Use the same server spelling you used for login. A hostname and port identify a different registry from another hostname or port, and you should not add a repository path such as /team/project: Docker registry addresses are normally just a hostname with an optional port.

$ docker logout registry.example.com:5000
Removing login credentials for registry.example.com:5000

Replace the placeholder with a registry you actually administer or use. The command does not need a running Docker daemon to remove the local entry.

For Docker Hub, omit the server only when the configured default is the one you want:

$ docker logout
Removing login credentials for https://index.docker.io/v1/

That confirmation wording is implementation output and can vary; it may show Docker Hub's internal address rather than the spelling you logged in with. A successful exit status is the part you can rely on, but it does not mean a token has been revoked remotely.

3. Treat the logout as a security-sensitive change

Check the server argument one more time before pressing Enter in a script or shared terminal. Logging out is local and usually reversible, but it can interrupt an automated pull or push that relies on this account. Never put passwords, access tokens or a full config.json into a ticket or shell transcript.

There is no elevated-privilege form needed for an ordinary user. Avoid sudo docker logout as a troubleshooting reflex: it selects root's Docker configuration and can report success while your user's credentials sit untouched.

Warning: if you are removing credentials because a token may have been exposed, logout alone is not enough. Revoke or rotate the token in the registry's account or security console, then log in again with a new credential if you need to. Docker logout cannot invalidate a token that has already been copied elsewhere.

4. Verify the local result

Run the same explicit logout a second time only if you need to check the target. A helper-backed configuration may report credentials as already absent, or still print a removal message; the wording depends on the helper.

$ docker logout registry.example.com:5000
Removing login credentials for registry.example.com:5000
$ printf 'exit status: %s\n' "$?"
exit status: 0

For a stronger end-to-end check, try an operation that needs private access, such as pulling a known private image, but only when that is safe in your environment. A failed authentication confirms the local login is gone. Do not test with an image that could trigger an unwanted download or expose a sensitive repository.

Do not treat grep auths ~/.docker/config.json as proof the logout worked. Docker may use credsStore or a per-registry credential helper, in which case the secret lives with that helper instead. The CLI command is the supported way to remove it.

5. Recover when the credential is needed again

Logging out does not delete images or containers, so there is no data to restore. If a later pull or push needs the registry, authenticate again with a token or password through the method that registry recommends:

$ docker login registry.example.com:5000
Username: YOUR_USERNAME
Password: YOUR_TOKEN
Login Succeeded

Use a token with the smallest useful permissions. For non-interactive automation, prefer the standard-input method, for example printf '%s\n' "$REGISTRY_TOKEN" | docker login registry.example.com:5000 --username YOUR_USERNAME --password-stdin. Keep the token in a secret manager or protected CI variable rather than in your command history; the placeholder values above are not real credentials.

If login succeeds but a pull still fails, check that hostname, port, repository permissions and image name all match. If the logout appeared to hit the wrong account, repeat it with the exact server and configuration context from step 1, then log in to the account you actually meant.

Done means