[derefr]

To put it another way:

1. a Docker registry is like (or maybe just is) an S3 bucket: a dumb, private object-store.

2. A docker index is a database-backed web service with a REST API, that clients talk to.

3. The web service can generate temporary tokens that let you GET things from, and PUT things in, the bucket.

4. The web service's database has a model of an image "project" similar to a Git repository: version history, branches, and other metadata.

5. The bucket contains the image repository's "object pool." Just like git, when you pull a branch, the client downloads all the "objects" required to check out that branch.