The authenticated account or unauthenticated IP/subnet exhausted its six-hour image pull allowance.
Why does this error happen?
- Anonymous CI, shared egress, uncached layers, or frequent clean builds consumed the scoped pull count.
- The effective account, plan, runtime, model, region, or deployment scope may be more restrictive than a headline platform maximum.
- Retries or parallel workers can amplify the condition when they are not bounded or coordinated.
How do you diagnose it?
- Read Docker's full 429 message and rate-limit headers to distinguish pull exhaustion from abuse throttling.
- Correlate the provider request identifier and UTC timestamp with application logs and metrics without recording secrets.
- Reproduce with the smallest safe request and verify the exact account, plan, endpoint, region, runtime, or model involved.
How do you fix it?
- Authenticate pulls, use a registry mirror or dependency proxy, preserve layer caches, and wait for reset.
- Retry only when the documented error is temporary; use bounded attempts, jitter, idempotency, and a dead-letter path.
- Verify recovery with a controlled request, then monitor the same limiter or failure signal under normal traffic.
How do you prevent it from recurring?
Turn the confirmed cause of 429 — pull rate limit exceeded into an observable boundary for Docker Hub. Track the relevant request count, token volume, payload size, execution time, connection pressure, billing state, or upstream health before it reaches the documented failure condition. Preserve the platform request ID and timestamp so future incidents can be correlated without logging sensitive payloads.
Test the fix under representative concurrency and failure injection, not only with one successful request. Alert on remaining headroom and repeated retries, and keep the linked limit page and official error source with the runbook so responders can distinguish a configuration problem from temporary service pressure or account state.