Docker Hub Pull limitation announcement impact

[Eduardo Asenjo]

Docker has recently sent a notification (https://www.docker.com/blog/docker-hub-image-retention-policy-delayed-and-subscription-updates/) where they will apply a limitation of pull for anonymous (based on IP) requests.

TL;DR of the announcement

On Monday, November 2, 2020 at 9am Pacific Standard Time, Docker will begin enforcing rate limits on container pulls for Anonymous and Free users. Anonymous (unauthenticated) users will be limited to 100 container image pulls every six hours, and Free (authenticated) users will be limited to 200 container image pulls every six hours

Since bitbucket-pipelines by default does not require any authentication I assume most of the downloads for any public image is done with no authentication, due is not necessary. Wonder what is the impact due thousands of users are executing bitbucket-pipelines from the same pool of IPs owned by Bitbucket on their servers.

The workaround here is easy for most of the cases, you can you update your bitbucket-pipelines.yml file to include the credentials of your new free user in Docker Hub and enjoy the current limitation of 200 pulls every six hours. For most of projects should be good enough.

Here the documentation for adding credentials using images

However my concern is around the usage of the pipes functionality, as far as I'm concern (please correct me if I'm wrong) when you execute a `pipe` there's not way to include at this moment credentials or something. Also in the documentation about pipes it remarks that the pipes containers have to be public

Possible workarround is to avoid the usage of pipes as it is and run it as a simple docker image with `docker run -e MY_VAR:MYVALUE -e MY_VAR2:Value2 domain/imagename:tag`

Wonder if Atlassian has any plans to provide some help for the usage of this tools meeting the new recent news related to this. 

Thanks!

[Theodora Boudale · Accepted solution]

Hi Eduardo,

In response to Docker's recent announcement, Bitbucket is working with Docker to ensure that Bitbucket Pipelines users can continue transparently using Docker Hub without pull rate limits nor any configuration.

So, from November 1st, users will not be impacted by any rate limits when pulling images from Docker Hub when using Bitbucket Pipelines.

We will be posting a public announcement with the following page, and we will recommend watching the page below for more updates from our team:
* Bitbucket Pipelines Community
* Bitbucket blog

Nonetheless, if you would like to authenticate while pulling the image from docker hub, this still can be done by passing your credentials, as you mentioned, with the following configuration:

image:
  name: openjdk:8
  username: $DOCKER_HUB_USERNAME
  password: $DOCKER_HUB_PASSWORD

You can find more details about authentication methods here.

Kind regards,
Theodora

[Eduardo Asenjo]

Outstanding! Thanks for the update and the quick response! I was quite frustrated with this due the short notice from Docker side (I didn't see any other announcement until I received the email 2 days ago)

Thanks again! 

[Theodora Boudale]

You are very welcome!

I just wanted to share here the bog post regarding this:

• https://bitbucket.org/blog/docker-hub-rate-limits-in-bitbucket-pipelines

Kind regards,
Theodora