# Inspect Docker Hub pull-limit headers with the documented HEAD check > Use the documented manifest HEAD diagnostic to inspect returned pull-limit information without making its counted GET request. - Canonical URL: https://update.dsesecurity.com/updates/inspect-docker-hub-pull-limit-headers-with-the-documented-head-check/ - Publisher: Detection Systems & Engineering (DSE Security) - Author: DSE Security Editorial Team - Published: 2026-10-30T06:04:24+00:00 - Modified: 2026-10-30T06:05:14+00:00 - Last reviewed by DSE: 2026-10-30 - Resource type: Guide - DSE priority: Advisory - Topics: IT, Networks & Infrastructure - Reading time: 3 minutes ## What you need to know Use the documented manifest HEAD diagnostic to inspect returned pull-limit information without making its counted GET request. ## Potentially affected Docker Hub pull-limit investigations using the documented manifest diagnostic. ## DSE recommendation Review the actual diagnostic headers and identity context before retrying a rate-limited pull. ## Article Bottom line: Use the documented header diagnostic before repeating a failed pull. Keep the request method, identity context and actual returned limits together, rather than copying example numbers into a retry decision. ## Source fact: documented behavior The [Docker Hub pull usage and limits](https://docs.docker.com/docker-hub/usage/pulls/) documentation is the primary reference. When an over-limit manifest pull triggers the documented Docker Hub pull-rate limit, the response is HTTP 429 with a pull-rate-limit message. For the documented diagnostic request, Docker returns limit headers with either GET or HEAD; GET emulates and counts as a pull, while HEAD does not. The example response identifies ratelimit-limit, ratelimit-remaining and docker-ratelimit-source as the headers to examine. ## What the source does not establish This article follows the specific Docker Hub manifest diagnostic. It does not promise that all HEAD requests are free, prescribe current plan quotas, identify every cause of HTTP 429 or approve a subscription change. Keep authentication, attribution and other rate-limiting investigations within their exact documented procedures. ## Applicability questions - Did the actual failure include the documented pull-rate-limit response? - Is the investigation reproducing anonymous or authenticated access? - Which method and endpoint does the approved diagnostic use? - What returned headers, timestamp and source context support the next retry decision? ## DSE recommendation: preserve the diagnostic context before retrying DSE recommends beginning with the original failure record, including the safe response text, manifest reference and time. Have the registry or pipeline owner classify that evidence before treating every 429 as the same condition. Preserve an unclassified response as an investigation finding rather than forcing it into this diagnostic. Follow the documented header-check workflow with the intended authentication context. Obtain any required token through the organization’s approved credential process. Keep tokens, passwords and authorization headers out of retained transcripts. Record whether the test was anonymous or authenticated without copying a reusable credential into the ticket. Review the request method before execution. Use the documented HEAD check when its scope matches the investigation, and avoid repeatedly substituting the counted GET diagnostic while trying to measure remaining allowance. Capture the actual returned header values and timestamp. Do not turn the source’s example allowance or address into a current policy for a different account or network. Have the pipeline owner choose a bounded next action from the observed result and the applicable service policy. Review avoidable repeated pulls, credential context and scheduled retry behavior separately. If expected headers are missing or the response differs, return to the relevant documented investigation instead of inventing a numerical limit or bypass. ## Verification and evidence Proposed verification, not performed: in an approved test context, inspect the original response and perform the documented HEAD diagnostic using the authorized credential workflow. Retain the method, endpoint identity, time, safe response status and returned limit-header values. Compare that evidence with the actual pipeline context before authorizing a harmless retry. Do not deliberately exhaust a shared allowance to demonstrate the error. If a GET comparison is needed, obtain approval for its documented counted behavior and record it as a separate case. Keep any observed pull success separate from permission, plan-entitlement or general registry-availability conclusions. ## Official references - [Docker Hub pull usage and limits](https://docs.docker.com/docker-hub/usage/pulls/) — Docker Docs. Source review completed October 30, 2026. Recheck the official documentation and deployment-specific applicability before a production change. ## Primary reference - Name: Docker Docs — Docker Hub pull usage and limits - Authority: docs.docker.com - URL: https://docs.docker.com/docker-hub/usage/pulls/ - Source publication date: Not stated by the source ## Citation and use Preferred citation: “Inspect Docker Hub pull-limit headers with the documented HEAD check,” DSE Security, https://update.dsesecurity.com/updates/inspect-docker-hub-pull-limit-headers-with-the-documented-head-check/ Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/ Usage and citation policy: https://update.dsesecurity.com/usage/ Copyright © 2026 Detection Systems & Engineering. All rights reserved.