Docker "pull rate limit for image without tag (latest)" in CI

An image reference with no tag resolves to :latest, and every build re-pulls it rather than reusing a pinned digest. On Docker Hub this consumes anonymous pull quota quickly across a busy CI fleet and trips the rate limit. Pinning a tag or digest, and authenticating, stops the bleed. Latchkey managed runners auto-retry transient infrastructure failures, so a momentary rate-limit blip is often cleared on retry - but a sustained limit needs the pinning/auth fix below.

What this error means

Builds intermittently fail pulling a base image written without a tag (e.g. FROM node) with toomanyrequests: You have reached your pull rate limit.

toomanyrequests: You have reached your pull rate limit. You may increase the limit by authenticating and upgrading: https://www.docker.com/increase-rate-limit

Common causes

An untagged base re-resolving to latest

A FROM node (no tag) re-pulls :latest every build, multiplying anonymous pulls.

Anonymous pulls across many runners

Unauthenticated pulls share a low IP-based quota that a fleet exhausts fast.

How to fix it

Pin a concrete tag or digest

1. Replace untagged FROM lines with a pinned tag (and ideally a digest).

# instead of: FROM node
FROM node:20.11-bookworm
# or pin by digest:
FROM node:20.11-bookworm@sha256:0123abcd...

Authenticate to raise the quota

1. Log in to Docker Hub before pulling so the higher authenticated quota applies.

echo "$DOCKERHUB_TOKEN" | docker login -u "$DOCKERHUB_USER" --password-stdin
docker build -t myorg/app:ci .

How to prevent it

• Always pin base image tags (and digests); never rely on implicit :latest.
• Authenticate Docker Hub pulls in CI to use the higher quota.

Related guides