ImagePullBackOff and ErrImagePull are two states in the same Kubernetes retry loop — ErrImagePull fires on the first failed pull, ImagePullBackOff is the waiting state between retries (exponential backoff capping at 5 minutes). Eight distinct root causes are covered: wrong image name or tag, missing imagePullSecret, expired credentials (including ECR's 12-hour token expiry), Docker Hub rate limits, unreachable registry, imagePullPolicy: Never, and architecture mismatch. For each cause, the exact error string visible in `kubectl describe pod` Events is mapped to a concrete fix, with ready-to-use kubectl commands and YAML examples. Key operational tips include patching the default ServiceAccount to inherit pull credentials namespace-wide, using IRSA/workload identity for cloud registries in production, and forcing an immediate retry after a fix via `kubectl delete pod` or `kubectl rollout restart` rather than waiting out the backoff timer.
