Anonymous pulls: is Docker Hub rate limit counted separately for two repositories?

.. or do all anonymous pulls made from the same IP address (e.g. corporate NAT) get aggregated and collectively count towards that single limit, regardless of the fact that the two Hub repo names are distinct? By that I mean Docker Hub repositories (not client usernames), e.g. bitnami in bitnami/mariadb vs. mirekphd in mirekphd/ml-mariadb.

Note that if these pull limits are not counted separately for each username, it would be impossible to download more than 100 randomly selected images within any given 6 hours period, even if you pay for your Hub account, because you are pulling from repos owned by someone else where you will never be able to authenticate (e.g. from the popular library repo).

The docs are ambiguous on this issue:

"Docker Hub limits the number of Docker image downloads (“pulls”) based on the account type of the user pulling the image. Pull rates limits are based on individual IP address. For anonymous users, the rate limit is set to 100 pulls per 6 hours per IP address." [..] "Unauthenticated (anonymous) users will have the limits enforced via IP."

>Solution :

Anonymous pulls are limited to 100 pulls per 6 hours per IP address. These are pulls and API requests that are not authenticated with username and password.

For authenticated users, it is 200 pulls per 6 hour period and is separate from IP address rate limits, and is separate for every user. However, you must authenticate your pulls.

The limits are irrespective of the specific repo you are pulling. Rate limits are enforced on the client, not the repository. Whether you are pulling an official image (eg docker pull python), a namespaced image (eg bitnami/foobar), or a private repo, they are all counted the same towards your API limits when you pull.

Leave a Reply