CannotPullContainer task errors in Amazon ECS

This error indicates that a connection timed out, because a route to the internet doesn't exist.

To resolve this issue, you can:

This means that the container image or repository can't be found.

When you specify an Amazon ECR image in your container definition, you must use the full URI of your Amazon ECR repository along with the image name in that repository.

To resolve this issue, verify the repository URI and the image name. Make sure that your task definition has the task execution IAM role. For more information about the task execution role, see Amazon ECS task execution IAM role.

This error indicates that there is a connection issue with the Amazon ECR endpoint.

For information about how to resolve this issue, see How can I resolve the Amazon ECR error "CannotPullContainerError: API error" in Amazon ECS on the Amazon Web Services Support website.

This error indicates that there is insufficient disk space.

To resolve this issue, free up disk space.

If you are using the Amazon ECS-optimized AMI, you can use the following command to retrieve the 20 largest files on your file system:

du -Sh / | sort -rh | head -20

Example output:

5.7G    /var/lib/docker/containers/50501b5f4cbf90b406e0ca60bf4e6d4ec8f773a6c1d2b451ed8e0195418ad0d2
1.2G    /var/log/ecs
594M    /var/lib/docker/devicemapper/mnt/c8e3010e36ce4c089bf286a623699f5233097ca126ebd5a700af023a5127633d/rootfs/data/logs
...

In some cases, the root volume might be filled out by a running container. If the container is using the default json-file log driver without a max-size limit, it may be that the log file is responsible for most of that space used. You can use the docker ps command to verify which container is using the space by mapping the directory name from the output above to the container ID. For example:

CONTAINER ID   IMAGE                            COMMAND             CREATED             STATUS              PORTS                            NAMES
50501b5f4cbf   amazon/amazon-ecs-agent:latest   "/agent"            4 days ago          Up 4 days                                            ecs-agent

By default, when using the json-file log driver, Docker captures the standard output (and standard error) of all of your containers and writes them in files using the JSON format. You can set the max-size as a log driver option, which prevents the log file from taking up too much space. For more information, see Configure logging drivers in the Docker documentation.

The following is a container definition snippet showing how to use this option:

{
    "log-driver": "json-file",
    "log-opts": {
        "max-size": "256m"
    }
}

An alternative, if your container logs are taking up too much disk space, is to use the awslogs log driver. The awslogs log driver sends the logs to CloudWatch, which frees up the disk space that would otherwise be used for your container logs on the container instance. For more information, see Using the awslogs log driver.

This error indicates that there is a Docker Hub rate limiting.

If you receive one of the following errors, you're likely hitting the Docker Hub rate limits:

For more information about the Docker Hub rate limits, see Understanding Docker Hub rate limiting.

If you have increased the Docker Hub rate limit and you need to authenticate your Docker pulls for your container instances, see Private registry authentication for container instances in the Amazon Elastic Container Service Developer Guide.

This error indicates that a connection timed out, because a route to the internet doesn't exist.

To resolve this issue, you can:

This error indicates that there was a failure when copying an image.

To resolve this issue, review one of the following articles:

This error indicates that there is no access to the image.

To resolve this issue, you might need to authenticate your Docker client with Amazon ECR For more information, see Private registry authentication in the Amazon ECR User Guide.

This error indicates that there is no access to the image because of an invalid memory address or nil pointer dereference.

To resolve this issue:

This error indicates a rate limit has been reached or there is a network error:

To resolve this issue, see How can I resolve the "CannotPullContainerError" error in my Amazon ECS EC2 Launch Type Task.

This error indicates that the context was cancelled.

The common cause for this error is because the VPC your task is using doesn't have a route to pull the container image from Amazon ECR.