Allow public endpoint attachement to Docker Team subscription for usage

[seanposner]

DockerHub now enforces vastly limited pull rates. For normal use, logging in to a paid account is simple. However, when using programmatic pull actions in external resources such as self hosted runners for CI processes or internal image pull for infrastructure, singing in is more convoluted.

I ask that you consider adding an internal IP allows list to be controlled by users to enable enforcing pull limits in all resources and streamlining the attachement of public endpoints to specific users.

The main desire is the capability to set an address being used as part of the overall rate limit for pulls.

[github-actions]

Thanks for your feedback 👍.

Our team will soon take a look at your issue.

In the meantime, feel free to give us as many details as possible, as this will speed up the resolution.

[sheltongraves]

Hey Sean, have you used an Organizational Access Token for your team subscription? https://docs.docker.com/enterprise/security/access-tokens/

[seanposner]

It is not sufficient. Having to "bake" a token on any level is cumbersome. In an example case of a same network K8s cluster we have to manage each node so that the container engine will have to authenticate using the token? But if they are all on the same network and Docker already is network resource aware since that is how the limit is enforced why not allow to whitelist an address to make everything more streamline and efficient. It's also less prone to configuration issues. I'm also sure that many users hesitate paying for premium grade accounts because of the overhead of this configuration, allowing an endpoint whitelist solution will make it much more valuable and will allow for more of an incentive to join.

[sheltongraves]

You can create a Kubernetes Secret with your Docker Hub credentials and then link that secret to a Service Account. Workloads using that Service Account will automatically use the credentials when pulling images from Hub. There are also some k8 operators that will do this automatically.