Kaniko "TOOMANYREQUESTS" Docker Hub pull rate limit in CI

Kaniko pulls the FROM base image before building. Docker Hub rate limits anonymous pulls per IP, and shared CI egress IPs hit that limit quickly, returning TOOMANYREQUESTS for the base image manifest.

What this error means

Kaniko fails on the FROM step with "TOOMANYREQUESTS: You have reached your pull rate limit" while retrieving the base image from registry-1.docker.io.

kaniko

error building image: error building stage: failed to get filesystem from image:
GET https://registry-1.docker.io/v2/library/node/manifests/20: TOOMANYREQUESTS:
You have reached your pull rate limit. You may increase the limit by authenticating

Common causes

Anonymous pulls share a rate-limited IP

Docker Hub caps anonymous pulls per IP; CI runners on shared egress exhaust the quota across many jobs.

No authenticated Docker Hub pull credential

Authenticated accounts get a higher limit, but Kaniko has no Hub credential in its config, so it pulls anonymously.

How to fix it

Authenticate the base image pull

Add a docker.io auth entry to the Kaniko config so pulls count against your account limit, not the anonymous IP limit.

Terminal

echo "{\"auths\":{\"https://index.docker.io/v1/\":{\"auth\":\"${HUB_AUTH_B64}\"}}}" \
  > /kaniko/.docker/config.json

Pull the base image through a mirror

Point FROM at a registry mirror or your own cache so builds do not hit Docker Hub directly on every job.

Dockerfile

# Use a mirrored base image
FROM registry.example.com/mirror/node:20

How to prevent it

Authenticate base image pulls to raise the Hub rate limit.
Mirror or cache frequently-pulled base images in your own registry.
Avoid pulling the same public base image anonymously across many parallel jobs.