{"record":{"id":"0d89383192a1cd47","repo":"kubernetes/kops","slug":"error-pulling-docker-image-with-s-v-s","errorCode":null,"errorMessage":"error pulling docker image with '%s': %v: %s","messagePattern":"error pulling docker image with '(.+?)': (.+?): (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/nodeup/nodetasks/pull_image.go","lineNumber":67,"sourceCode":"}\n\nfunc (t *PullImageTask) GetName() *string {\n\tif t.Name == \"\" {\n\t\treturn nil\n\t}\n\treturn &t.Name\n}\n\nfunc (e *PullImageTask) Run(c *fi.NodeupContext) error {\n\t// Pull the container image\n\targs := []string{\"ctr\", \"--namespace\", \"k8s.io\", \"images\", \"pull\", e.Name}\n\thuman := strings.Join(args, \" \")\n\n\tklog.Infof(\"running command %s\", human)\n\tcmd := exec.Command(args[0], args[1:]...)\n\toutput, err := cmd.CombinedOutput()\n\tif err != nil {\n\t\treturn fmt.Errorf(\"error pulling docker image with '%s': %v: %s\", human, err, string(output))\n\t}\n\n\treturn nil\n}\n","sourceCodeStart":49,"sourceCodeEnd":72,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/nodeup/nodetasks/pull_image.go#L49-L72","documentation":"The pull_image task builds a docker pull command, executes it with exec.Command, and if the command exits non-zero wraps the combined stderr/stdout into this error. It means docker itself reported a failure pulling the container image (not a kOps-level validation failure).","triggerScenarios":"`docker pull <image>` fails: image not found in the registry, registry auth required, no network/DNS to the registry, or the docker daemon is down.","commonSituations":"Typo'd or deleted image tag in a hook/manifest; private registry (ECR/GCR) without credentials on the node; rate limiting from Docker Hub; EKS/K8s nodes without registry pull secrets.","solutions":["Inspect the combined output in the error for the docker-level cause (e.g. 'manifest unknown', 'unauthorized', 'Cannot connect to the daemon').","Verify the image reference (registry/repo:tag) exists and the node can reach the registry.","Configure registry credentials (docker login / credHelpers in /root/.docker/config.json) for private registries.","Ensure the docker daemon is running: systemctl status docker."],"exampleFix":"// before\ndockerPull: registry.example.com/private/app:v1\n// after: ensure auth then correct tag\ndockerPull: registry.example.com/private/app:v1.2.3  # tag exists, creds configured","handlingStrategy":"retry","validationCode":"if err := exec.Command(\"docker\", \"manifest\", \"inspect\", imageRef).Run(); err != nil {\n    return fmt.Errorf(\"image %s not resolvable before pull\", imageRef)\n}","typeGuard":null,"tryCatchPattern":"if err != nil {\n    if strings.Contains(string(output), \"toomanyrequests\") || strings.Contains(string(output), \"connection refused\") {\n        // retry with backoff; otherwise fail fast\n    }\n}","preventionTips":["Pin image tags that exist and are immutable","Configure registry credentials on the node (docker login/credHelpers)","Pre-pull images or use a local registry mirror"],"tags":["docker","container-image","registry","nodeup"],"backgroundTag":"docker-pull-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}