Docker: "Pull Access Denied" — Registry Auth, Names, and Rate Limits

The registry refused the pull: not authenticated, the image name is wrong (the classic missing namespace), or the Hub rate limit hit. The error text names which of the three.

What you'll see

Error response from daemon: pull access denied for <image>, repository does not exist or may require 'docker login'
Pushes to the repo work, pulls (or CI pulls) fail
Suddenly fails in CI after working for months (rate-limit signature)

Root causes

Image name wrong: missing namespace/tag

docker pull myapp looks for library/myapp on Docker Hub — YOUR image is username/myapp. The error says access denied, but nothing about it was private. docker images on the build machine shows the real name.

Private registry without credentials (or expired ones)

docker login needed for that registry on that machine/CI runner. CI tokens rotate; expired ones produce the same message as never-logged-in.

Docker Hub rate limits

Anonymous pulls are capped per IP (shared CI NATs hit it fast). toomanyrequests / 429 in the error is the tell — pulls that 'should work' failing intermittently.

Fix it

Verify the image name including namespace

docker pull <user>/<image>:<tag>   # exact, never the namespace-less shortcut

Authenticate for private images

echo "$TOKEN" | docker login -u <user> --password-stdin <registry>   # stdin keeps it out of the process list

CI: check the runner's auth state

# GH Actions: use docker/login-action with the right registry; expired PAT = silent 401s

Rate limits: mirror or authenticate (authenticated pulls get a higher cap)

# docker login (free account raises the cap) ; or configure the runner to pull from a mirror you control

Field note

push access denied vs pull access denied overlap in wording: pushes fail with auth/permissions on the repo, pulls fail with name/auth/rate-limit. Read which verb the daemon reported before debugging credentials. Images built locally under a short name exist only locally: pushing tags them with the full path, and pulling requires using it.

Common questions

Why does docker pull myapp fail but docker run myapp works locally?

The local image satisfies run without a pull. Any context forcing a real pull (new machine, --pull flag, compose with pull policy) reveals the name/auth problem that was hidden all along.

How do I check if I'm rate limited?

Pull any public image and read the error: toomanyrequests means capped. token.docker.dev shows your current tier; authenticated pulls raise the ceiling immediately.

Ship it right the first time

A production-shaped compose stack: healthchecks, resource limits, log rotation. Never debug a boot race again.

Docker Production Starter — $19 →

One-time. Yours to modify. Instant download from the NinjaOps template store.

Docker: "Pull Access Denied" — Registry Auth, Names, and Rate Limits

What you'll see

Root causes

Image name wrong: missing namespace/tag

Private registry without credentials (or expired ones)

Docker Hub rate limits

Fix it

Field note

Common questions

Related fixes

Ship it right the first time

Get new fixes by email

Vultr — our lab-environment pick for this stack