What causes ImagePullBackOff / ErrImagePull and how do you resolve it?
Quick Answer
Kubernetes cannot pull the container image. Common causes: wrong image name/tag, the image does not exist, a private registry needs credentials (imagePullSecrets), or network/registry is unreachable.
Detailed Answer
kubectl describe pod shows the exact pull error. Check the image name and tag for typos, that the tag exists in the registry, and for private registries that an imagePullSecret is configured on the pod/service account. Also verify nodes can reach the registry (network/DNS/proxy) and that credentials have not expired. ErrImagePull is the immediate failure; ImagePullBackOff is Kubernetes backing off between retries.
Code Example
kubectl describe pod <pod> | grep -A5 Events docker pull <image> # reproduce the pull manually
Interview Tip
Distinguish ErrImagePull (the failure) from ImagePullBackOff (the retry back-off), and mention imagePullSecrets for private registries.