Clarification on Docker Hub Rate Limits for pulls inside Docker Executor (without Remote Docker)

Build Environment
1

Hi there,

I’m seeking clarification on the Docker Hub rate limit policy for April 2025, specifically regarding the Docker Executor.

We know that the primary image defined in the docker: key is exempt from rate limits due to the CircleCI-Docker partnership. However, what is the status of images pulled within a job step?

For example, if we use a tool like Jib (which pulls base images directly via API) or run a custom script that pulls images without using setup_remote_docker, does CircleCI’s automatic authentication still apply?

Specifically:

  1. Does the “partnership” coverage extend to the outbound traffic from the primary container to Docker Hub?

  2. Or does the primary container operate as an “Anonymous” user (subject to the stricter unauthenticated limits) unless we manually run docker login within the step?

I’d appreciate it if you could clarify the boundary of the “automatic authentication.”