{"record":{"id":"977414060414bfd9","repo":"vxcontrol/pentagi","slug":"failed-to-pull-default-image-s-w","errorCode":null,"errorMessage":"failed to pull default image '%s': %w","messagePattern":"failed to pull default image '(.+?)': %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"backend/pkg/docker/client.go","lineNumber":283,"sourceCode":"\t\t\tlogger.WithError(err).Error(\"failed to update container info in database\")\n\t\t}\n\t}\n\n\tfallbackDockerImage := func() error {\n\t\tlogger = logger.WithField(\"image\", dc.defImage)\n\t\tlogger.Warn(\"try to use default image\")\n\t\tconfig.Image = dc.defImage\n\n\t\tdbContainer, err = dc.db.UpdateContainerImage(ctx, database.UpdateContainerImageParams{\n\t\t\tImage: config.Image,\n\t\t\tID:    dbContainer.ID,\n\t\t})\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"failed to update container image in database: %w\", err)\n\t\t}\n\n\t\tif err := dc.pullImage(ctx, config.Image); err != nil {\n\t\t\treturn fmt.Errorf(\"failed to pull default image '%s': %w\", config.Image, err)\n\t\t}\n\n\t\treturn nil\n\t}\n\n\tif err := dc.pullImage(ctx, config.Image); err != nil {\n\t\tlogger.WithError(err).Warnf(\"failed to pull image '%s' and using default image\", config.Image)\n\t\tif err := fallbackDockerImage(); err != nil {\n\t\t\tdefer updateContainerInfo(database.ContainerStatusFailed, \"\")\n\t\t\treturn database.Container{}, err\n\t\t}\n\t}\n\n\tlogger.Info(\"creating container\")\n\n\tconfig.Hostname = fmt.Sprintf(\"%08x\", crc32.ChecksumIEEE([]byte(containerName)))\n\tconfig.WorkingDir = WorkFolderPathInContainer\n","sourceCodeStart":265,"sourceCodeEnd":301,"githubUrl":"https://github.com/vxcontrol/pentagi/blob/ea665308baaff015b226f308438a68d929d0f29b/backend/pkg/docker/client.go#L265-L301","documentation":"If even the default image (dc.defImage, default debian:latest) cannot be pulled, RunContainer returns \"failed to pull default image '%s': %w\" and marks the container Failed in the database. At this point the environment has no way to obtain any usable sandbox image, so container startup fails hard — the daemon/registry is the culprit, not the caller's image choice.","triggerScenarios":"dc.pullImage(ctx, dc.defImage) fails: no internet/DNS in the environment, registry rate limiting (Docker Hub 429), private registry requires auth, image name typo in DOCKER_DEFAULT_IMAGE, daemon offline, or insecure-registry TLS rejection.","commonSituations":"Air-gapped or firewalled deployments that never pre-pulled debian:latest; Docker Hub toomanyrequests rate limit on shared IPs; DOCKER_DEFAULT_IMAGE set to a tag that does not exist; corporate proxy without docker daemon proxy config (HTTP_PROXY in /etc/docker/daemon.json or systemd drop-in).","solutions":["Pre-pull the default image on the host: docker pull <default-image> (resolves both connectivity and rate limits until restart).","Set DOCKER_DEFAULT_IMAGE to an image available in your environment (local registry/mirror).","Configure registry mirrors or docker login for the private registry; check rate-limit errors in the wrapped cause.","Fix daemon-level network/proxy: HTTP_PROXY/HTTPS_PROXY/NO_PROXY in /etc/systemd/system/docker.service.d/*.conf, then restart docker.","Verify the image tag exists (docker manifest inspect <image>) if DOCKER_DEFAULT_IMAGE was customized."],"exampleFix":"// before (.env)\nDOCKER_DEFAULT_IMAGE=debian:bookworm-slim-typo\n// after\ndocker pull debian:bookworm-slim\nDOCKER_DEFAULT_IMAGE=debian:bookworm-slim","handlingStrategy":"retry","validationCode":"img := cfg.DockerDefaultImage\nif img == \"\" { img = \"debian:latest\" }\nout, err := exec.Command(\"docker\", \"manifest\", \"inspect\", img).CombinedOutput()\nif err != nil { return fmt.Errorf(\"default image %s unavailable: %s\", img, out) }","typeGuard":null,"tryCatchPattern":"err := dc.RunContainer(ctx, name, ctype, flowID, cfg, hostCfg)\nif strings.Contains(err.Error(), \"failed to pull default image\") {\n    // transient registry/network failures: retry with backoff\n    return retryWithBackoff(ctx, 3, 5*time.Second, func() error {\n        return runWithImage(ctx, fallbackImage)\n    })\n}","preventionTips":["Pre-pull the default image in the Dockerfile / entrypoint / CI deploy step.","Use a local registry mirror or internal registry as DOCKER_DEFAULT_IMAGE source.","Configure daemon proxies and registry mirrors for restricted networks.","Validate DOCKER_DEFAULT_IMAGE tags exist before rollout.","Handle Docker Hub rate limits with authenticated pulls (docker login) or paid plans."],"tags":["docker","image-pull","registry","network"],"backgroundTag":"image-pull-failed","analyzedSha":"ea665308baaff015b226f308438a68d929d0f29b","analyzedAt":"2026-09-01T14:16:31.421Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}