policy rate_limiting ai_generated true

toomanyrequests: You have reached your pull rate limit. You may increase the limit by authenticating.

ID: policy/docker-hub-pull-rate-limit

Also available as: JSON · Markdown
85%Fix Rate
88%Confidence
3Evidence
2023-01-01First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
any active — — —

Root Cause

Docker Hub limits anonymous pulls to 100/6hr per IP, authenticated free to 200/6hr. CI/CD systems sharing an IP (NAT) quickly exhaust the limit. Kubernetes clusters pulling the same image from multiple nodes multiply the pull count.

generic

Workarounds

  1. 95% success Use a registry mirror/proxy (Harbor, JFrog, AWS ECR pull-through cache) 
    ECR pull-through cache: aws ecr create-pull-through-cache-rule --ecr-repository-prefix docker-hub --upstream-registry-url docker.io
  2. 92% success Copy frequently-used images to your private registry 
    docker pull nginx:latest && docker tag nginx:latest myregistry.com/nginx:latest && docker push myregistry.com/nginx:latest
  3. 88% success Use imagePullPolicy: IfNotPresent in Kubernetes to reduce pulls 
    Set imagePullPolicy: IfNotPresent and use specific tags (not :latest) to leverage node-level image cache

Dead Ends

Common approaches that don't work:

  1. Authenticate with Docker Hub to get unlimited pulls 82% fail

    Authenticated free accounts get 200/6hr, not unlimited. Only paid Docker Pro/Team/Business get higher limits.

  2. Pull images less frequently to stay under the limit 78% fail

    In Kubernetes, each node independently pulls images. 10 nodes pulling on deploy = 10 pulls even if the image is the same.