> Fetch the index of every Tonbo docs page as Markdown at https://tonbo.dev/llms.txt

# Image pulls

Last updated 2 November 2026

> Machines are not open yet. These pages describe Machines as they will open; until then, a create answers [`region_not_offered`](https://tonbo.dev/docs/machines/troubleshooting/manage.md#region_not_offered) (422), “Machines are not offered in any region yet.”

Find out what Tonbo does with your image, from its reference to the disk a wake boots, when an image is slow to become ready or is refused.

## Resolution

At a create, and at an update that names an image, Tonbo’s API resolves the reference: it reads the [image index](https://github.com/opencontainers/image-spec/blob/v1.1.0/image-index.md) and picks the `linux/arm64` [manifest](https://github.com/opencontainers/image-spec/blob/v1.1.0/manifest.md), built as [multi-platform builds](https://docs.docker.com/build/building/multi-platform/) make them, and stores its digest with the canonical repository. A name with no registry host is a Docker Hub name. Nothing else is resolved later, so a new push under the same tag is not seen until it is named again.

## The pull

A host pulls by digest, anonymously, over HTTPS on port 443, as the [distribution specification](https://github.com/opencontainers/distribution-spec/blob/v1.1.0/spec.md) describes. Manifests are never followed through a redirect and blobs through at most three; every blob’s digest is checked. The layers are flattened into one [ext4](https://docs.kernel.org/filesystems/ext4/index.html) filesystem, with the [image configuration](https://github.com/opencontainers/image-spec/blob/v1.1.0/config.md) kept beside it, and cached on the host. A Machine that wakes on another host is pulled there again. Some registries limit anonymous pulls per address, and every Machine of a region pulls from one address.

## The limits

A host refuses an image past the bounds on [Limits](https://tonbo.dev/docs/machines/limits.md#image), and bounds every pull in time and memory.

## Failures

A pull that fails records why on the Machine, which `tonbo machine show` prints, and wakes are refused with [image_failed](https://tonbo.dev/docs/machines/troubleshooting/call.md#image_failed) until an update names an image that pulls. The specifications end at the [OCI image specification’s repository](https://github.com/opencontainers/image-spec).