# Docker "pull policy always but offline" in CI

> Fix Docker pull failures with `--pull always` in CI when the runner is offline or air-gapped - the daemon must reach the registry but cannot.

Source: https://latchkey.dev/learn/docker/docker-pull-policy-always-but-offline-in-ci  
Updated: 2026-06-26

With `--pull always` (or a compose `pull_policy: always`), the daemon contacts the registry on every run even if the image is cached locally. On an offline or air-gapped runner that contact fails, and the run aborts even though a usable image already sits in the local store.

## Diagnose it: read the container, not the compose file

A container that exits immediately in CI has almost always logged the reason and then been cleaned up. Capture the logs and the exit code before changing configuration.

```Terminal
# why did it stop?
docker ps -a --format '{{.Names}}\t{{.Status}}\t{{.Image}}'
docker logs <container> 2>&1 | tail -50
docker inspect <container> --format '{{.State.ExitCode}} {{.State.OOMKilled}} {{.State.Error}}'
```

> `OOMKilled: true` means the kernel killed it for memory, and no amount of application debugging will explain the log. Exit code 137 is the same event seen from outside.

## FAQ

### What causes Docker "pull policy always but offline" in CI?

There are 2 common causes: pull-always on an offline runner and no registry mirror reachable. The policy forces a registry round-trip the air-gapped or network-restricted runner cannot complete.

### How do I fix Docker "pull policy always but offline" in CI?

There are 2 fixes depending on which cause you have: use the cached image with pull missing/never and pre-load the image before going offline. Work through them in order, since the first is the most common.

### What does Docker "pull policy always but offline" in CI actually mean?

A docker run --pull always (or compose up) fails with a network/registry error while a locally cached image of the same tag is present.

### How do I stop Docker "pull policy always but offline" in CI happening again?

On offline runners, set pull policy to missing or never. The prevention section lists 2 changes that keep it from recurring.

---

Latchkey runs CI/CD that repairs its own failures. Agent entry points: https://latchkey.dev/agent.txt, https://latchkey.dev/openapi.json, https://latchkey.dev/llms.txt