I'd like to build my own layer on top of a public Docker image. Fine, I know how to do that. However, my layer will contain proprietary code that I can't share in a public docker image. I do, however want to be able to share it among servers inside my organization.
Is my only option to run my own instance of docker registry? Or are there workflows that allow moving of layers/images around without a central repository?
You can:
docker save and docker load,To expand on Jerome's answer, we are one of the private Docker registry services: Quay.io
We offer a robust permissions model that should be sufficient for your needs, including teams, shared organizations, and individual repository level controls.
We have many companies using us to store their proprietary code and to distribute it within their datacenters. If you do consider using us, I am sure your first questions will deal with the security of our service, for which we have dedicated a special page on our site: Security
We run Gandalf.io, an affordable private docker registry service. You'll like Gandalf.io if you need to get started with private dockers quickly and inexpensively. Its still pretty much in the early stages so we're offering just one service - private docker sharing among teams using the docker cli - and its works well for that use case.