Docker "toomanyrequests: You have reached your pull rate limit" (Anonymous) in CI
By Kaveh Alemi·Latchkey
Docker Hub throttled the pull. toomanyrequests: You have reached your pull rate limit for an anonymous pull means the shared IP-based limit was hit - CI runners behind shared egress exhaust the anonymous quota quickly. Authenticating raises the limit.
What this error means
A docker pull / FROM docker.io/... fails with toomanyrequests: You have reached your pull rate limit. You may increase the limit by authenticating and upgrading. Pulls succeed again later or after logging in.
docker
toomanyrequests: You have reached your pull rate limit. You may increase the limit
by authenticating and upgrading: https://www.docker.com/increase-rate-limit
Common causes
Anonymous pulls share a low IP-based limit
Unauthenticated pulls count against a per-IP quota shared by everyone behind the same egress, so CI hits it fast.
No Docker Hub authentication in CI
Without docker login, pulls use the anonymous tier; an authenticated account has a higher limit.
Repeated base-image pulls without a cache/mirror
Pulling the same base image on every job, with no pull-through mirror, multiplies the request count.
How to fix it
Authenticate to Docker Hub in CI
Log in with an account so pulls use the higher authenticated limit.
Mirror/cache base images and retry transient throttles
Pull base images from a mirror or your own registry, and retry an isolated throttle.
How to prevent it
Authenticate to Docker Hub in every job that pulls from it.
Mirror or cache base images to cut pull volume.
Pin base images in your own registry where practical.
Frequently asked questions
What causes ""toomanyrequests: pull rate limit""?
Unauthenticated pulls count against a per-IP quota shared by everyone behind the same egress, so CI hits it fast.
How do I fix "toomanyrequests: pull rate limit"?
Log in with an account so pulls use the higher authenticated limit.
Can Latchkey fix this automatically?
Yes. Latchkey runs your GitHub Actions on managed runners that detect this failure, apply the fix, and retry the job automatically - self-healing is on by default.
