The 'pull access denied' error occurs when Docker cannot download an image from a registry. This typically happens due to a typo in the image name, the image not existing on the registry, or authentication being required for a private repository.
This error message indicates that the Docker daemon was unable to pull (download) the requested image from the container registry. Docker prints this error when one or more of the following conditions are met: 1. **The image name or tag is incorrect** - There may be a typo in the repository name, namespace, or tag 2. **The repository does not exist** - The image you're trying to pull has not been pushed to the registry 3. **Authentication is required** - The repository is private and you need to log in first 4. **Rate limiting** - You may have exceeded the registry's pull rate limit for anonymous or free-tier users The Docker daemon tries to find the image locally first. When it's not found, it attempts to pull from the default registry (Docker Hub) or a specified private registry. If any of the above conditions apply, this error is returned.
First, confirm that the image name is spelled correctly and exists on Docker Hub or your target registry.
# Search for the image on Docker Hub
docker search nginx
# Check available tags at hub.docker.com or use the API
# For example, visit: https://hub.docker.com/_/nginx/tagsCommon naming mistakes:
- mongodb should be mongo
- ngnix should be nginx
- postgress should be postgres
If using a specific tag, verify the tag exists on the registry.
If the repository requires authentication, log in before pulling:
# Log in to Docker Hub
docker login
# Or log in to a private registry
docker login registry.example.comImportant: If you use sudo for Docker commands, you must also use sudo when logging in:
sudo docker login
sudo docker pull myimage:tagYour credentials are stored in ~/.docker/config.json (or /root/.docker/config.json when using sudo).
Always use the complete image path including the registry and namespace:
# Instead of just the image name
docker pull myimage
# Use the full path
docker pull docker.io/myusername/myimage:tag
# For private registries, include the registry URL
docker pull registry.example.com/myproject/myimage:tagFor Docker Hub official images, the namespace is library:
docker pull docker.io/library/nginx:latestIf your docker-compose.yml references images that should be built locally, build them first:
# Build all images defined in docker-compose.yml
docker-compose build
# Or build a specific service
docker-compose build myservice
# Then start the services
docker-compose upCheck your docker-compose.yml for any image: references that point to local images rather than remote ones. These need a corresponding build: section or must be built separately.
Docker Hub has rate limits for image pulls:
- Anonymous users: 100 pulls per 6 hours
- Authenticated free users: 200 pulls per 6 hours
- Paid subscriptions: Higher limits
To check your current rate limit status:
# Get an auth token and check limits
TOKEN=$(curl -s "https://auth.docker.io/token?service=registry.docker.io&scope=repository:library/alpine:pull" | jq -r .token)
curl -sI -H "Authorization: Bearer $TOKEN" https://registry-1.docker.io/v2/library/alpine/manifests/latest | grep -i ratelimitIf rate limited, either:
1. Wait for the limit to reset (6 hours)
2. Log in to Docker Hub to get higher limits
3. Use a Docker Hub mirror or cache
If you're still having issues after logging in, try resetting your Docker credentials:
# Log out from Docker Hub
docker logout
# Or log out from a specific registry
docker logout registry.example.com
# Remove the credentials file (backup first if needed)
mv ~/.docker/config.json ~/.docker/config.json.backup
# Log in again
docker loginThis clears any corrupted or outdated credentials that might be causing authentication failures.
### Private Registry Authentication
For private registries other than Docker Hub, you may need to include the port in your login command:
# If your image name includes a port
docker login registry.example.com:5000
docker pull registry.example.com:5000/myimage:tag### GitHub Container Registry (GHCR)
For GitHub Container Registry, use a Personal Access Token (PAT):
echo $GITHUB_PAT | docker login ghcr.io -u USERNAME --password-stdin
docker pull ghcr.io/owner/image:tag### CI/CD Environments
In CI/CD pipelines, ensure credentials are properly configured:
# GitHub Actions example
- name: Login to Docker Hub
uses: docker/login-action@v3
with:
username: ${{ secrets.DOCKERHUB_USERNAME }}
password: ${{ secrets.DOCKERHUB_TOKEN }}### Terms of Service Requirements
Some images (like Oracle Database) require you to accept terms of service on the registry website before pulling. Even with valid credentials, pulls will fail until you accept the terms through the web interface.
### Debugging Authentication Issues
Check where Docker is looking for credentials:
cat ~/.docker/config.jsonThe auths section shows which registries have stored credentials. The credsStore field indicates if you're using a credential helper (like osxkeychain on macOS or wincred on Windows).
dockerfile parse error line 5: unknown instruction: RRUN
How to fix 'unknown instruction' Dockerfile parse error in Docker
Error response from daemon: manifest for nginx:nonexistent not found: manifest unknown: manifest unknown
How to fix 'manifest for image:tag not found' in Docker
Error response from daemon: invalid reference format: repository name must be lowercase
How to fix 'repository name must be lowercase' in Docker
Error response from daemon: No such image
How to fix 'No such image' in Docker
Error response from daemon: Container is not running
How to fix 'Container is not running' when using docker exec