Decide whether compute workloads support anonymous (credential-less) image pulls

[scotwells]

Decision needed: should Datum compute workloads support anonymous (credential-less) pulls of public images at all?

Even where anonymous pulls work, Docker Hub applies aggressive per-IP rate limits to unauthenticated pulls — and edge nodes aggregate many workloads behind few IPs, so anonymous pulls would throttle unpredictably at scale.

Options

1. Require pull credentials for all registries. Credential-less image references fail validation with a clear error. Predictable behavior; avoids rate-limit blowups entirely.
2. Support anonymous pulls with documented rate-limit caveats.
3. Platform-managed pull-through cache/mirror as the longer-term answer for public images (compatible with either of the above).

Runtime bug (context — moot if option 1 is chosen)

The Unikraft runtime's node agent presents credentials on every pull even when none are configured anywhere, so anonymous pulls of public images fail today — registries reject with 401/403 (Docker Hub: "incorrect username or password"). Undocumented agent knobs AGENT_OCI_REGISTRY_CREDS / AGENT_OCI_REGISTRY_HOST may be the intended configuration path; this is an open vendor question raised via datum-cloud/unikraft-provider#68.

Exit criteria

• Product decision recorded.
• If anonymous pulls are in scope: the runtime bug above becomes a vendor blocker.
• If not: document the credential requirement in user-facing docs and surface a clear validation error for credential-less image references.

[scotwells]

Verified facts: anonymous image pulls across the industry

Fact-checked against primary sources (registry and vendor docs, fetched 2026-07-09) to inform the options in this issue.

Registry limits

• Docker Hub anonymous: 100 pulls per 6 hours, per IPv4 address (or IPv6 /64). The widely-cited "10 pulls/hour" was a 2025 change Docker rescinded before enforcement; they've committed to 6 months' notice before any future tightening.
• Free credentials raise the limit to only 200 pulls/6h (per account). Unlimited pulls require a paid plan, subject to an unquantified fair-use policy.
• Per-IP enforcement means shared egress pools the quota. Docker, GitLab, and Google independently document this failure mode (CI runners, private GKE clusters behind one NAT gateway). Docker warns even authenticated pulls from a shared IP can trigger abuse rate limiting.
• Docker Hub is the outlier: quay.io has no pull-count limit (only generic per-IP request throttling); ECR Public serves anonymous pulls with 500 GB/month free bandwidth.

Platform behavior

Provider	Requires creds for public images?	Mitigation shipped
GKE / Google	No — Hub treats GKE as anonymous by default	mirror.gcr.io cache, default-on in GKE
AWS (EKS/ECS guidance)	No	ECR pull-through cache; ECR Public
Azure (AKS/ACA guidance)	No	ACR artifact cache
GitLab CI	No	Dependency Proxy pull-through cache
Kubernetes (upstream)	No — imagePullSecrets optional	Node-local image cache
Fly.io	No	Copies image into Fly's registry at deploy (single pull); external private registries unsupported
Railway	No (private creds are Pro-plan only)	None documented — shared-IP 429 incident fixed reactively by staff
Render	No	Re-pulls every deploy; maintains a public-image cache on the build path
Koyeb	No	None documented (docs silent on rate limits)
Cloudflare Containers	No (external refs allowed since Mar 2026)	Managed registry is the default path; external pulls explicitly uncached, docs warn of Hub pull limits

• No surveyed platform requires credentials for public images — zero-credential public deploys are table stakes across hyperscalers, managed Kubernetes, GitLab CI, and all five PaaS/edge providers; credentials are everywhere an optional add-on for private images. (Remaining unverified: ghcr.io's own limits; Koyeb's staff stance, login-gated thread.)
• Two mitigation models exist: pull-through caches (hyperscalers, GitLab) and copy-into-platform-registry at deploy time (Fly always, Cloudflare's default) — a single upstream pull per deploy instead of per node/restart. Direct-pull platforms (Railway, Render, Koyeb, Cloudflare external refs) absorb the shared-IP exposure, and it has caused real, staff-acknowledged 429 incidents at Fly and Railway, fixed reactively rather than by design.
• Caching Docker Hub requires upstream credentials on both AWS and Azure — their cache rules mandate a Hub credential; even the hyperscalers don't pull the Hub anonymously behind their caches.
• Transparent mirrors are partial protection: mirror.gcr.io caches frequently-accessed images best-effort, and misses fall through to Docker Hub where the per-IP limit applies to the node's egress IP.

Related: anonymous pulls fail on our runtime today regardless of this decision — the node agent sends credentials even when none are configured (vendor bug, tracked via datum-cloud/unikraft-provider#68's hand-off).

Sources: Docker Hub usage docs · Docker policy blog (Apr 2025) · GKE mitigation blog · Artifact Registry Hub-cache docs · ECR pull-through cache docs · ACR artifact cache overview · GitLab rate-limit KB · quay.io limits (Red Hat KB) · Fly.io config docs · Railway services docs · Render image deploys · Koyeb prebuilt images · Cloudflare Containers image management