= The action of using --link to access the container on the bridge network does not accomplish the goal of creating a container that is reachable from its host's network. The --link option allows you to connect containers that are running on the same network, but it does not expose the container's ports to the host1. To create a container that is reachable from its host's network, you need to use the --network host option, which attaches the container to the host's network stack and makes it share the host's IP address2. Alternatively, you can use the --publish or -p option to map the container's ports to the host's ports3.
Legacy container links | Docker Documentation : Networking using the host network | Docker Documentation : docker run reference | Docker Documentation

While removing push access from all other users can prevent an image from being overwritten, it's not the only way and might not be the most efficient or practical solution, especially in a collaborative environment.
Docker Trusted Registry (DTR) provides a feature called 'Immutable Tags' which can be used to prevent an image, such as 'nginx:latest', from being overwritten. Once a tag is marked as immutable, DTR will prevent any user from pushing the same tag to the repository, thus preserving the image. This allows for better version control and prevents accidental overwrites. Therefore, the solution to prevent an image from being overwritten is not just to remove push access from all other users, but to use the features provided by DTR like 'Immutable Tags'.

= Setting INSECURE_REGISTRY in the /etc/docker/default configuration file is one way to configure the Docker engine to use a registry without a trusted TLS certificate. This option tells the Docker daemon to accept insecure connections to the specified registry, bypassing the certificate verification1. However, this method is not recommended, as it exposes the registry and the Docker engine to potential security risks2. A better way to use a registry without a trusted TLS certificate is to add the registry's CA certificate to the Docker daemon's trust store, as described in the Docker documentation3 or other online guides4. References:
* 1: How to build docker registry without SSL
* 2: Verify repository client with certificates | Docker Docs
* 3: "docker pull" certificate signed by unknown authority
* 4: Login to docker registry with client certificate under windows

Explanation
= A DTR security scan will detect private keys copied to the image. DTR security scan is a feature of Docker Trusted Registry (DTR) that scans images to detect any security vulnerability1. DTR security scan uses the open source tool SecretScanner2 to find unprotected secrets in container images or file systems. SecretScanner can match the contents of images against a database of approximately 140 secret types, including private keys3. Therefore, if an image contains private keys, DTR security scan will report them as potential secrets and alert the user to remove them from the image. References:
* Scan images for vulnerabilities | Docker Docs
* GitHub - deepfence/SecretScanner: :unlock: Find secrets and passwords ...
* SecretScanner/deepfence_secret_scanner.py at main deepfence/SecretScanner

Explanation
Using docker logs <container-id> does not configure a Docker container to export container logs to the logging solution. The docker logs command shows information logged by a running container, such as standard output and standard error streams. It does not send or export container logs to any external service.
References: https://docs.docker.com/engine/reference/commandline/logs/,
https://docs.docker.com/config/containers/logging/