You download an image from a registry using the docker image pull command. When you run the command, the Docker service connects to the registry, authenticates - if it needs to - and pulls the image down. The pull process downloads all the image layers and stores them in the local image cache on the machine. Containers can only be run from images that are available in the local image cache, so unless they're built locally, they need to be pulled first.
One of the earliest commands you run when you get started with Docker on Windows is something simple, like this example from Chapter 2, Packaging and Running Applications as Docker Containers_SSR:
> docker container run dockeronwindows/ch02-powershell-env
Name Value
---- -----
ALLUSERSPROFILE C:\ProgramData
APPDATA C:\Users\ContainerAdministrator\AppData...
