Latest / The Cloud Business Podcast with Fexingo: AWS, Azure, GCP, and Enterprise Infrastructure / Cloud Contracts Now Charge for Container Image Pull Frequency
Transcript
- Lucas: So earlier this year, a mid-sized fintech — about 400 employees, running mostly on AWS — completed their migration to a full Kubernetes-native architecture. Containers everywhere. Their cloud bill the next month jumped eighteen percent, and nobody in engineering could figure out why. Luna: Eighteen percent — that's not a rounding error. What was driving it? Lucas: They traced it to a single line item they'd never seen before: container image pull charges. Their cloud provider had quietly introduced a per-pull fee for images stored in the registry. And because their CI/CD pipeline was pulling fresh images every deploy — sometimes dozens of times a day — the costs stacked up fast. Luna: Wait — so they were being charged for pulling an image they already stored in the same cloud provider's registry? That used to be free, right? Lucas: Exactly. Historically, data transfer within the same region was free. But starting late last year, all three major cloud providers — AWS, Azure, GCP — began updating their container registry terms. They introduced per-pull pricing for images. AWS ECR now charges $0.001 per pull for images under 1 GB, and up to $0.05 per pull for gpu enabled images. Azure Container Registry has a tiered model where the first 5,000 pulls per month are free, then $0.003 per pull after that. GCP Artifact Registry charges per gigabyte pulled — about $0.10 per GB for standard images. Luna: And the fintech was pulling, say, a 2-gigabyte image twenty times a day across multiple clusters? That adds up fast. Lucas: Exactly. They had about 150 microservices, each with a separate image, and their CI pipeline rebuilt and redeployed on every merge to main. So that's 150 images times – say – ten pulls a day. At $0.003 per pull, that's four dollars and fifty cents a day. But they had multiple environments — dev, staging, production — so multiply by three. That's over four hundred dollars a month just on pull fees. And that was on top of storage. Luna: And if that sounds like a small amount — I mean, for a company spending maybe a hundred thousand a month on cloud, four hundred bucks is not huge, but the growth rate is what worries me. As they scale, those pulls scale linearly. Lucas: Right. And the providers are counting on that. The real money isn't in the per-pull fee per se — it's in the fact that container adoption is accelerating. Kubernetes is now the standard way to deploy in enterprise, and with that comes image sprawl. Every microservice, every environment, every deployment tag creates more pulls. Luna: And this is a perfect example of why these conversations matter. If you're building or running infrastructure, keeping up with these contract changes is the difference between a predictable bill and a surprise. What we do here — breaking down these shifts — it takes time. If you find it useful, you can support the show at buy me a coffee dot com slash fexingo. No pressure, but it helps keep this ad-free. Lucas: Yeah, and honestly, that fintech could have avoided the shock if they'd read the fine print. So let's dig into what's actually in these new contract clauses and how you can protect yourself. Luna: What does the wording look like? I imagine it's buried in the registry service terms, not the headline pricing page. Lucas: Buried is the right word. AWS added a sentence to the ECR service terms under 'Data Transfer and API Usage' — it says, and I'm paraphrasing, 'Each image pull constitutes an API request and is subject to additional charges as set forth in the pricing schedule.' Azure's terms are more explicit: 'Container image pulls exceeding the free tier will be billed per pull at the applicable rate.' GCP ties it to egress: 'Artifact Registry charges for data transferred out of the registry to compute resources.' Luna: So the ambiguity is around whether pulling an image to a compute instance in the same zone counts as 'data transfer out' or not. GCP seems to say it does. Lucas: That's exactly the issue. And it's not just compute pulls. If you have a multi-cluster setup and you pull the same image into two different clusters in the same region, you're billed twice. Some teams have started using image streaming — pulling only the layers needed to start a container — to reduce the data transferred per pull. Luna: Image streaming is one workaround, but it has trade-offs. It can increase startup latency for cold starts because you're fetching layers on demand. And not all images are compatible — especially if you're using GPU images with large weights. Lucas: True. Another approach is aggressive layer caching. If you build your Dockerfiles to maximize shared layers — like keeping your base OS layer and runtime layer separate from your application code — then when you update code, only the top layer changes. The base layers are already cached on the node, so you don't pull them again. That can cut pull volume by sixty or seventy percent. Luna: But that requires discipline in the build process. And if you're using a CI/CD tool that rebuilds the entire image from scratch every time, you lose that benefit. Lucas: Right. And that fintech I mentioned was rebuilding from scratch. So they were pulling the full image every time. After they realized the issue, they switched to a multi-stage build with a slim base image and started using Amazon ECR's pull-through cache for public images. They also implemented a policy to only pull images when the digest changed — not on every deploy. That cut their pull count by about eighty percent. Luna: So the fix was more about process than technology. But what about companies that rely on public images from Docker Hub or other registries? Are they seeing fees too? Lucas: Great question. Docker Hub introduced pull rate limits years ago — anonymous users get 100 pulls per six hours, authenticated users get 200. But they haven't added per-pull billing for authenticated users yet. However, the cloud providers are now charging for egress when you pull from an external registry into their cloud. So if you're on AWS and you pull an image from Docker Hub, you pay for the data transfer out of Docker Hub — if Docker Hub charges — and you may also pay for the data transfer into AWS if it's not free. It's a double whammy. Luna: That would hit companies that use a multi-cloud strategy. If you pull an image from a gcp hosted registry into an AWS cluster, you're paying egress on both sides potentially. Lucas: Exactly. And that's becoming more common as enterprises adopt a best of breed approach. The industry's answer is the Open Container Initiative — OCI — which standardizes image formats and distribution. But it doesn't standardize pricing. Luna: So what's the playbook for a cloud architect in 2026? How do you negotiate these clauses in a contract renewal? Lucas: First, audit your current pull volume. Most companies don't know how many pulls they're doing per month because it's never been a cost center. Use your cloud provider's cost and usage reports — filter by API calls to the container registry. Second, ask for a cap. In enterprise contracts, you can negotiate a flat fee for registry operations, including pulls. Some providers will agree to a fixed monthly cost if you commit to a certain storage volume. Luna: And what about service-level agreements? If you're paying per pull, you'd expect a guarantee that pulls are fast and reliable. Lucas: That's another negotiation lever. AWS ECR has a service-level agreement of 99.9 percent availability for image pulls. But if you're paying per pull, you might want a higher SLA or credits if pull latency exceeds a threshold. Some large customers have gotten clauses that cap per-pull charges at a percentage of total spend — say, no more than two percent of the monthly compute bill. Luna: That makes sense. And I think we're going to see more innovation in image distribution as a result. Things like peer to peer image distribution within a cluster — using tools like Kraken or Dragonfly — to avoid hitting the registry at all. Lucas: Absolutely. Some organizations are already running their own registry mirrors on-premises or in a co-location facility, and then only pulling from the cloud registry when the image changes. That shifts the cost from per-pull to per-update, which is much lower frequency. Luna: So the takeaway: container image pull fees are real, they're growing, and they're here to stay. The smart play is to measure, optimize your build process, and negotiate upfront. Lucas: Exactly. And going back to that fintech — after they implemented the changes, their pull fees dropped from four hundred dollars a month to about sixty. They also improved their deploy times because they weren't pulling full images every time. So it was a net positive. Luna: That's a good note to end on — sometimes these contract changes force you to adopt better practices. Maybe that's the silver lining. Lucas: I think that's the right way to look at it. Alright, that's it for this episode. Until next time.