Downloads an image (or just its newer layers) from a registry without starting a container from it.
A full image reference is registry/namespace/repository:tag@digest. Missing parts get defaults:
docker.io (Docker Hub)library/ (official images):latestSo nginx really means docker.io/library/nginx:latest.
:latest or :1 can point to a new image tomorrow. Pin versions (or digests) in productionpull access denied / manifest unknown means a typo in the name or tag, a private image without docker login, or no build for your CPU (e.g. arm64 Mac)