Error: image not found

Docker "image not found" in CI environments is almost always an authentication problem. On a developer's machine, docker login credentials persist in the system keychain. CI runners start with a clean credential state. Docker Hub's anonymous pull rate limit (100 pulls per 6 hours for unauthenticated IPs) means high-traffic CI runners on shared cloud IP ranges hit the limit and receive "image not found" or "too many requests" rather than a clear authentication error. For GitHub Actions, authenticate at the start of each job using stored secrets: For Docker Hub: docker login -u $DOCKERHUB_USERNAME -p $DOCKERHUB_TOKEN (injected from GitHub Secrets). For GitHub Container Registry: use docker login ghcr.io with the GITHUB_TOKEN secret. For AWS ECR: use the aws-actions/amazon-ecr-login action. Private images in AWS ECR require IAM role permissions for ecr:GetAuthorizationToken, ecr:BatchGetImage, and ecr:GetDownloadUrlForLayer. Missing any of these returns an authorization error that Docker reports as "image not found" — a deliberately unhelpful message that avoids leaking information about whether the image exists but makes debugging harder. Caching Docker images in CI using Docker layer caching (docker/build-push-action with cache-from: type=gha) reduces both Docker Hub rate limit exposure and build time, as cached layers are pulled from GitHub's artifact cache rather than Docker Hub.