With --pull always (or a compose pull_policy: always), the daemon contacts the registry on every run even if the image is cached locally. On an offline or air-gapped runner that contact fails, and the run aborts even though a usable image already sits in the local store.
What this error means
A docker run --pull always (or compose up) fails with a network/registry error while a locally cached image of the same tag is present.
docker
docker: Error response from daemon: Get "https://registry-1.docker.io/v2/": dial tcp: lookup registry-1.docker.io: no such host.
Diagnose it: read the container, not the compose file
A container that exits immediately in CI has almost always logged the reason and then been cleaned up. Capture the logs and the exit code before changing configuration.
Terminal
# why did it stop?
docker ps -a --format '{{.Names}}\t{{.Status}}\t{{.Image}}'
docker logs <container> 2>&1 | tail -50
docker inspect <container> --format '{{.State.ExitCode}} {{.State.OOMKilled}} {{.State.Error}}'
Common causes
Pull-always on an offline runner
The policy forces a registry round-trip the air-gapped or network-restricted runner cannot complete.
No registry mirror reachable
A restricted network with no reachable mirror has nothing for the always-pull to hit.
How to fix it
Use the cached image with pull missing/never
Switch the policy to missing (pull only if absent) or never when offline.
Terminal
docker run --pull missing myorg/app:ci
# fully offline with a pre-loaded image:
docker run --pull never myorg/app:ci
Pre-load the image before going offline
Save the image to a tar in a connected step and load it on the offline runner.
Terminal
docker save myorg/app:ci -o app.tar
docker load -i app.tar
docker run --pull never myorg/app:ci
How to prevent it
On offline runners, set pull policy to missing or never.
Pre-load required images via docker save/docker load.
Frequently asked questions
What causes Docker "pull policy always but offline" in CI?
There are 2 common causes: pull-always on an offline runner and no registry mirror reachable. The policy forces a registry round-trip the air-gapped or network-restricted runner cannot complete.
How do I fix Docker "pull policy always but offline" in CI?
There are 2 fixes depending on which cause you have: use the cached image with pull missing/never and pre-load the image before going offline. Work through them in order, since the first is the most common.
What does Docker "pull policy always but offline" in CI actually mean?
A docker run --pull always (or compose up) fails with a network/registry error while a locally cached image of the same tag is present.
How do I stop Docker "pull policy always but offline" in CI happening again?
On offline runners, set pull policy to missing or never. The prevention section lists 2 changes that keep it from recurring.
