Twelve of us, everyone develops on Docker Desktop on Macs, and our CI pulls base images from Hub on more or less every build. Someone asked in standup whether we are technically in breach and nobody in the room knew the answer. What are the actual thresholds to check, and separately, what happens on the Hub side when CI starts hitting pull limits?
On the Hub side, the limits are per six hour rolling window and they are tighter than most teams assume. Unauthenticated pulls are limited by IP address, and shared CI runners are the classic disaster because you are sharing that IP with everyone else on the platform, so you can hit a limit having pulled almost nothing yourself. Authenticating with even a free account raises the ceiling and, more importantly, moves the counter from an IP you do not control to an account you do. That single change fixes the majority of mystery 429s in CI.
The shared runner IP thing is why it always looks random. Two green builds then a failure with no change on your side.
And it is never in the error people paste. They see a pull failure and start blaming the registry generally.
Two completely separate things get muddled here and you need to answer them separately. Docker Desktop licensing: it is free for personal use, education and open source, and free for commercial use in small businesses, where small is defined as fewer than 250 employees and less than ten million dollars in annual revenue. You are twelve people, so the employee half is not close, and the only question is your revenue, which is a thing your finance person can answer in about a minute and I cannot. Docker Hub pull limits are a different product with different rules and hitting them costs you build failures rather than a licensing problem.
Good to know it is an and rather than an or on that test. I had assumed headcount alone settled it.
It is deliberately both, so a tiny company with large revenue is still expected to pay. Read the current terms yourself rather than trusting a forum post, including this one, since they have changed before.
Worth noting the licence applies to Docker Desktop, the packaged app, not to the engine or the CLI. Several people on our team moved to alternatives that run the engine in a lightweight VM without Desktop, and that sidesteps the question entirely on Macs. It is not free, it costs you some polish and about an afternoon per developer, and if your team is not comfortable in a terminal it will not be popular. For a twelve person agency that is probably not worth doing purely to avoid a licence you may well not need.
Get the revenue answer from whoever signs your accounts rather than from a thread, since that half of the test is a business fact and getting it wrong is a contract problem rather than a technical one. The engineering half, meaning authenticate your CI and cache your base images, you should do regardless of what the answer turns out to be.
@attic_server · 3mo ago
The structural fix for CI is to stop pulling from Hub on every build. Run a pull through cache or mirror, or push the base images you actually use into your own registry and pull from there, and your build pipeline stops depending on someone else's quota entirely. It also makes builds faster and means an outage at a registry you do not control is not an outage for you. We did this after two afternoons lost to rate limits and it has never come up again.
Reply
Report