How to fix toomanyrequests: Rate exceeded for anonymous users in Docker

# Interactive login
docker login

# Using environment variables (for CI/CD)
echo "$DOCKER_HUB_TOKEN" | docker login -u "$DOCKER_HUB_USERNAME" --password-stdin

# Check remaining pulls (authenticated users only)
TOKEN=$(curl --silent "https://auth.docker.io/token?service=registry.docker.io&scope=repository:ratelimitpreview/test:pull" | jq -r .token)
curl --head -H "Authorization: Bearer $TOKEN" https://registry-1.docker.io/v2/ratelimitpreview/test/manifests/latest 2>&1 | grep -i ratelimit

# Look for: ratelimit-remaining: 199;w=21600

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - name: Login to Docker Hub
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Build and push
        run: docker build -t myimage .

docker-build:
  image: docker:latest
  services:
    - docker:dind
  before_script:
    - echo "$DOCKER_HUB_TOKEN" | docker login -u "$DOCKER_HUB_USERNAME" --password-stdin
  script:
    - docker build -t myimage .

pipeline {
  agent any
  environment {
    DOCKER_CREDENTIALS = credentials('dockerhub-creds')
  }
  stages {
    stage('Login') {
      steps {
        sh 'echo $DOCKER_CREDENTIALS_PSW | docker login -u $DOCKER_CREDENTIALS_USR --password-stdin'
      }
    }
  }
}

kubectl create secret docker-registry dockerhub-secret \
  --docker-server=https://index.docker.io/v1/ \
  --docker-username=YOUR_USERNAME \
  --docker-password=YOUR_TOKEN \
  [email protected]

apiVersion: apps/v1
kind: Deployment
metadata:
  name: my-app
spec:
  template:
    spec:
      imagePullSecrets:
        - name: dockerhub-secret
      containers:
        - name: app
          image: myuser/myimage:latest

kubectl patch serviceaccount default -p '{"imagePullSecrets": [{"name": "dockerhub-secret"}]}'

# docker-compose.yml
version: "3.8"
services:
  registry-mirror:
    image: registry:2
    ports:
      - "5000:5000"
    environment:
      REGISTRY_PROXY_REMOTEURL: https://registry-1.docker.io
      REGISTRY_STORAGE_CACHE_BLOBDESCRIPTOR: inmemory
    volumes:
      - registry-data:/var/lib/registry

volumes:
  registry-data:

{
  "registry-mirrors": ["http://localhost:5000"]
}

sudo systemctl restart docker

# Instead of:
docker pull nginx:latest

# Use Google's mirror:
docker pull mirror.gcr.io/library/nginx:latest

# Many popular images are available on ECR Public
docker pull public.ecr.aws/docker/library/nginx:latest

# For Microsoft images
docker pull mcr.microsoft.com/dotnet/aspnet:8.0

docker pull quay.io/prometheus/prometheus:latest

# Pull from Docker Hub
docker pull nginx:1.25

# Tag for your private registry
docker tag nginx:1.25 your-registry.com/nginx:1.25

# Push to your registry
docker push your-registry.com/nginx:1.25

# Install crane
go install github.com/google/go-containerregistry/cmd/crane@latest

# Copy directly without pulling locally
crane copy nginx:1.25 your-registry.com/nginx:1.25

skopeo copy docker://nginx:1.25 docker://your-registry.com/nginx:1.25

spec:
  containers:
    - name: app
      image: myimage:v1.2.3  # Use specific tags
      imagePullPolicy: IfNotPresent  # Only pull if not cached

# Bad - always pulls to check for updates
image: nginx:latest
imagePullPolicy: Always

# Good - pulls once, then uses cache
image: nginx:1.25.3
imagePullPolicy: IfNotPresent

# Use a DaemonSet to pre-pull images to all nodes
kubectl apply -f - <<EOF
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: image-prepull
spec:
  selector:
    matchLabels:
      name: image-prepull
  template:
    metadata:
      labels:
        name: image-prepull
    spec:
      initContainers:
        - name: prepull
          image: nginx:1.25.3
          command: ["sh", "-c", "exit 0"]
      containers:
        - name: pause
          image: gcr.io/google_containers/pause:3.2
EOF