GitHub Actions "Docker pull failed" for a job container image

Before any step runs, the runner pulls the image named under "container:". A wrong tag, a private registry without credentials, or a transient registry hiccup aborts the whole job at startup. On Latchkey managed runners, transient registry pull failures are auto-retried and warm pools keep popular base images pre-pulled.

What this error means

The job fails during the "Initialize containers" phase with a Docker pull error, before any of your steps execute.

##[error]Docker pull failed with exit code 1
Error response from daemon: manifest for ghcr.io/acme/builder:latst not found: manifest unknown

Common causes

Wrong image name or tag

A typo in the repository or tag (for example "latst") resolves to a manifest that does not exist.

Private registry without credentials

The image lives in a private registry but the job did not provide container.credentials, so the pull is unauthorized.

Transient registry error

A 5xx or network timeout from the registry can fail an otherwise valid pull.

How to fix it

Fix the reference and add credentials

1. Correct the image name and tag; verify it with "docker pull" locally.
2. For private registries, supply container.credentials with a username and token secret.
3. Re-run the job.

jobs:
  build:
    runs-on: ubuntu-latest
    container:
      image: ghcr.io/acme/builder:latest
      credentials:
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}

How to prevent it

• Pin container images to immutable digests or known-good tags.
• Store registry credentials as secrets and reference them under container.credentials.

Related guides