A push needs a name that says where the image goes, docker.io/<account>/<repository>:<tag>. docker tag adds that name without copying anything, and docker push uploads the layers the registry lacks. Without a login, Docker Hub 514 refuses before any layer moves:
docker tag l3-booknest-api:latest docker.io/booknestdemo/booknest-api:1.3
docker push docker.io/booknestdemo/booknest-api:1.3 2>&1 | grep -o 'push access denied[^:]*'
docker rmi docker.io/booknestdemo/booknest-api:1.3push access denied, repository does not exist or may require authorization Untagged: booknestdemo/booknest-api:1.3
With an account, create a personal access token with Read & Write scope under Account settings, log in with echo "$DOCKERHUB_TOKEN" | docker login -u <account> --password-stdin instead of the password, so the token can be revoked on its own, and push docker.io/<account>/booknest-api:1.3 (not run here: this book uses no Docker Hub account). The first push creates the repository, public by default. Without a credential helper such as docker-credential-pass, docker login stores the credential base64-encoded in ~/.docker/config.json.