GHCR vs Docker Hub for CI: Rate Limits, Auth & Speed
Docker Hub rate limits are a top cause of CI flakiness - GHCR changes the trade-offs.
Both store container images; they differ on rate limits, auth, and how tightly they integrate with GitHub Actions.
| Docker Hub | GHCR | |
|---|---|---|
| Rate limits | Strict for anonymous pulls | Tied to GitHub auth |
| Auth in Actions | Manual login | GITHUB_TOKEN built-in |
| Best for | Public base images | Your own images + GitHub workflows |
In CI
Pushing/pulling your own images via GHCR with the built-in GITHUB_TOKEN avoids Docker Hub anonymous rate limits (the classic toomanyrequests failure). For public base images, authenticate to Docker Hub or mirror them.
The verdict
Store your own images in GHCR for seamless Actions auth; authenticate or mirror Docker Hub base images to dodge rate limits.
Related guides
Docker "toomanyrequests: rate limit exceeded" - Fix Docker Hub Pull LimitsFix Docker Hub "toomanyrequests: You have reached your pull rate limit" in CI by authenticating, caching imag…
Is Docker Hub Down? How to Check and Keep Your CI GreenCheck if Docker Hub is down and stop it from failing your CI. How to read the status page, confirm it is an o…
How to Cache Docker Layers in GitHub ActionsSpeed up Docker builds in GitHub Actions with BuildKit registry cache - cache-from/cache-to, gha cache backen…