docker: manifest unknown

Manifest Unknown in CI pipelines is frequently an authentication problem disguised as a network or image error. CI runners do not inherit your local Docker login session and must authenticate explicitly. For Docker Hub, GitHub Container Registry (GHCR), and AWS ECR, the pattern is the same: add a docker login step before any docker pull or docker build that uses authenticated images. Store credentials as CI secrets — never hard-code tokens in workflow files. For AWS ECR specifically, the authentication token expires every 12 hours, so automated pipelines must re-authenticate on each run using aws ecr get-login-password | docker login. For Docker Hub, use a dedicated bot account with limited permissions rather than a personal account token. Rate limiting is another CI-specific cause: Docker Hub's anonymous pull limit (100/6 hours) is exhausted quickly in CI when many runners pull the same base image. Authenticate even for public images to raise the limit to 200/6 hours, or use GHCR which has no pull rate limits.