A registry is a store for images
Once built, an image is pushed to a registry so other machines can pull it. Docker Hub is the public one. Every cloud provider runs their own, and companies host private registries.
Deployment is usually just: the server pulls an image from a registry and runs it.
Docker
builds the image
Registry
stores it
Kubernetes
pulls and runs it
Three different tools, three separate security surfaces.