PromptHub
Back to Errors
DevOps Error ErrImagePull Intermediate 138 views

Kubernetes Image Pull Back Off

Kubernetes cannot pull the container image from the registry.

Explanation

Image Pull Back Off (ErrImagePull) occurs when Kubernetes cannot pull the container image specified in the pod spec. Kubernetes retries with exponential backoff, hence "Back Off". Common causes include wrong image name or tag, image doesn't exist in the registry, authentication required but credentials not provided, registry is unreachable, image has been deleted, or the node doesn't have network access to the registry. The error message includes the specific pull failure reason.

Common Causes

  • Wrong image name or tag
  • Image doesn't exist in registry
  • Missing image pull credentials
  • Registry is unreachable
  • Image deleted from registry

Solution

Check the image name and tag: kubectl describe pod. Verify the image exists: docker pull image-name:tag. For private registries, create an image pull secret: kubectl create secret docker-registry. Ensure the secret is referenced in the pod spec: imagePullSecrets. Check node network connectivity to the registry. Verify registry credentials haven't expired. For Docker Hub, check rate limits. Use image digest instead of tag for immutable deployments. Check pod events for specific error messages: kubectl get events.

Code Example 

# Check pod events
kubectl describe pod myapp-pod-xyz
# Look for: Failed to pull image "myregistry/myapp:latest": rpc error

# Verify image exists locally
docker pull myregistry/myapp:latest

# For private registry, create pull secret
kubectl create secret docker-registry regcred \
    --docker-server=myregistry.com \
    --docker-username=user \
    --docker-password=pass

# Reference secret in deployment
apiVersion: apps/v1
kind: Deployment
spec:
  template:
    spec:
      containers:
      - name: myapp
        image: myregistry/myapp:latest
      imagePullSecrets:
      - name: regcred

# Check if image tag exists
docker manifest inspect myregistry/myapp:latest

# Use specific tag, not latest
image: myregistry/myapp:v1.2.3  # better than :latest

# For public registries, no auth needed
image: nginx:1.25  # Docker Hub public image

Error Information

Language

bash

Framework

kubernetes

Difficulty

Intermediate

Views

138

Related Errors

502 DevOps

Nginx 502 Bad Gateway

Nginx received an invalid response from the upstream server (PHP-FPM, Node.js, etc.).
DevOps

Terraform State Locked

Another Terraform operation is already running and has locked the state file.
504 DevOps

Nginx 504 Gateway Timeout

Nginx didn't receive a response from the upstream server within the timeout period.
DevOps

Docker Permission Denied

The current user doesn't have permission to run Docker commands.
All tools