Quick answer
Docker Hub documents six-hour pull allowance as Unauthenticated: 100 per IPv4/IPv6 subnet; Personal: 200. Paid plans have unlimited pulls subject to fair use.
Verified Aug 22, 2026Official source
Current limits
| Constraint | Current value | Scope | Verified source |
|---|---|---|---|
| six-hour pull allowancePaid plans have unlimited pulls subject to fair use. | Unauthenticated: 100 per IPv4/IPv6 subnet; Personal: 200 | Unauthenticated and Personal | DockerAug 22, 2026 |
Why does this limit matter?
Shared CI egress IPs can exhaust the unauthenticated allowance across unrelated builds.
This value is scoped to Unauthenticated and Personal; a different plan, runtime, model, endpoint, region, or account can produce a different effective constraint.
What should you check?
- Authenticate CI pulls and inspect Docker's rate-limit headers for the effective scope.
- Confirm the exact plan, model, runtime, endpoint, region, and account that serve the failing workload.
- Record the observed value, response headers or configuration, timestamp, and source without logging secrets.
Important caveats
- Abuse-rate limiting is separate from the documented pull allowance and has a different 429 message.
- Treat the official source and live account configuration as authoritative if they differ from this verified snapshot.
HyperObserve reports the documented platform constraint. Your application, SDK, gateway, provider, region, or account can impose a lower effective limit.
Related