guides
Docker Hub rate limits are a CI problem, not a Docker problem
Anonymous pulls are rate-limited per IP, and CI runners share IPs. Here is how to stop finding out at 3am.
Priya Raghavan · Infrastructure · 2026-07-15 · 6 min read
Docker Hub rate-limits anonymous pulls per source IP. Hosted CI runners come from shared cloud ranges, so your build is sharing a quota with strangers. The failure is intermittent, arrives without warning and looks like a network problem.
Why it hits CI specifically
A developer laptop pulls a base image once and caches it for weeks. A CI fleet pulls the same image on every ephemeral runner, thousands of times a day, from addresses it does not control.
Fixes, in order of durability
- Run a registry pull-through cache in the same network as your runners — one upstream pull serves every job afterwards
- Authenticate pulls even for public images; an authenticated pull draws on your account's quota rather than the shared anonymous one
- Mirror the handful of base images you actually depend on into your own registry and pin them by digest
- Stop pulling images you do not need — multi-stage builds often pull a toolchain image no runtime layer uses
Your next build could be twice as fast, at half the price
Start free. Migrating away is the same one line, and we publish that diff too.
Related
CI when your teammates are agentsAI coding agents push far more often than humans. Here is how that changes pipeline design and cost control.Why we publish instructions for leavingEvery migration page on this site includes the diff to migrate back off us. Here is the reasoning.What we learned running a million CI jobsQueue time, cache behaviour, right-sizing and the failure modes that only appear at scale.Stop retrying flaky testsAutomatic retries convert a real bug into an intermittent one, and train your team to distrust every failure.