A Pod is stuck in ImagePullBackOff — what are the usual causes and first checks?
A freshly-created Pod never becomes Ready — its status is ImagePullBackOff. You have the pod list and the describe Events below. Say what this status means, name the usual causes, and give the fix for what these events actually show.
$ kubectl get pod web-7d9c8
NAME READY STATUS RESTARTS AGE
web-7d9c8 0/1 ImagePullBackOff 0 90s
$ kubectl describe pod web-7d9c8
Events:
Warning Failed kubelet Failed to pull image "myco/web:latset":
docker.io/myco/web:latset: not found
Warning Failed kubelet Error: ErrImagePull
Normal BackOff kubelet Back-off pulling image "myco/web:latset"Diagnose and fix.
ImagePullBackOff is the kubelet failing to pull the image and backing off. Read the describe Events — here latset is a typo, so the registry returns not-found; fix the tag. Other causes: a missing imagePullSecret, wrong host, or a rate limit.
- ✗Confusing
ImagePullBackOffwith a crashing container instead of a failed pull - ✗Skipping the
describeEvents, which name the exact pull failure - ✗Forgetting that a private image needs an
imagePullSecret
- →How do you attach an
imagePullSecretso a Pod can pull from a private registry? - →Why is a mutable tag like
latestrisky for reproducible deploys?
Solution
1. What the status means
ImagePullBackOff is the kubelet failing to pull the image and backing off with an exponential delay between retries. The container has not run yet, so there are no app logs.
2. Read the Events
Failed to pull image "myco/web:latset": docker.io/myco/web:latset: not foundThe reason is stated outright: the tag latset is a typo of latest — no such tag exists.
3. Fix and the other usual causes
- typo / non-existent tag → fix the tag (here
latest); - private registry → attach an
imagePullSecretto the Pod/ServiceAccount; - wrong registry host → correct the full image path;
- rate limit (Docker Hub) → authenticate or use a mirror.
