429: toomanyrequests for https://ghcr.io/v2/falcosecurity/plugins/plugin/container

[oprudkyi-sxp]

unable to pull artifact falcosecurity/plugins/plugin/container with tag 0.4.0 from repo falcosecurity/plugins/plugin/container: GET "https://ghcr.io/v2/falcosecurity/plugins/plugin/container/manifests/sha256:2c6f56657df53e55ae32ba81b6a818a9b7fec5f04ea38e174fe717187236567f": response status code 429: toomanyrequests: retry-after: 1.16676ms, allowed: 44000/minute", "timestamp":"2025-11-17 07:38:07"

similar to falcosecurity/rules#331

[oprudkyi-sxp]

/kind bug

[irozzo-1A]

Thanks for reporting @oprudkyi-sxp we noticed the same, it's under investigation.

[irozzo-1A]

FYI

📣 Hi Falconers
We need a quick hand to mitigate an ongoing issue with the GitHub Container Registry.
If you’re not using the rules auto-update feature (falcoctl artifact follow, enabled by default in the Helm chart), you can safely ignore this.
👉 Context
About three years ago we started distributing Falco artifacts (rules files and plugins) via ghcr.io, and later added automatic rule updates in falcoctl with a 6h check interval. With years of data now, it’s clear we don’t need checks that frequent. Our rule updates happen far less often.
😱 What’s happening
Falco usage has grown a lot this year, and these frequent checks are now hitting ghcr.io rate limits.
If you’re seeing log messages like:
response status code 429: toomanyrequests: retry-after: 141.62µs, allowed: 44000/minute
this is the reason. It’s affecting both user installations and our CI.
🙏 What we kindly ask
Please increase your auto-update interval to 7 days (or any longer interval that fits your setup) if you rely on ghcr.io for automatic rule updates.
You can do this by:
Using Helm: upgrade to the latest chart v7.0.2.
Manual install: set falcoctl.config.artifact.update.every=168h (Helm) or every: 168h0m0s in /etc/falcoctl/falcoctl.yaml.
Alternatively, you can:
Use a local registry proxy (e.g., Harbor) to mirror ghcr.io.
Disable auto-updates if you don’t need them.
Thanks a lot for your understanding and support! It really helps the whole community ❤️

https://kubernetes.slack.com/archives/CMWH3EH32/p1764157554440079