Git operations rate limits

Common Git operations, like clones, fetches, and pushes, can generate many requests in a short time. Rate limits on Git HTTP, Git LFS, Git SSH, and Git push operations protect the security and durability of your GitLab instance. Each of these limits works differently with the general user and IP rate limits. Each section explains how.

Git HTTP

If you use Git HTTP in your repository, common Git operations can generate many Git HTTP requests. GitLab can enforce rate limits on both authenticated and unauthenticated Git HTTP requests to improve the security and durability of your web application.

Git HTTP on GitLab.com

On GitLab.com, Git HTTP requests are subject to Git HTTPS request rate limits.

Configure unauthenticated Git HTTP rate limits

GitLab disables rate limits on unauthenticated Git HTTP requests by default.

Prerequisites:

• You must have administrator access.

To apply rate limits to Git HTTP requests that do not contain authentication parameters, enable and configure these limits:

1. In the upper-right corner, select Admin.
2. In the left sidebar, select Settings > Network.
3. Expand Git HTTP rate limits.
4. Select Enable unauthenticated Git HTTP request rate limit.
5. Enter a value for Max unauthenticated Git HTTP requests per period per user.
6. Enter a value for Unauthenticated Git HTTP rate limit period in seconds.
7. Select Save changes.

Configure authenticated Git HTTP rate limits

GitLab disables rate limits on authenticated Git HTTP requests by default.

Prerequisites:

• You must have administrator access.

To apply rate limits to Git HTTP requests that contain authentication parameters, enable and configure these limits:

1. In the upper-right corner, select Admin.
2. In the left sidebar, select Settings > Network.
3. Expand Git HTTP rate limits.
4. Select Enable authenticated Git HTTP request rate limit.
5. Enter a value for Max authenticated Git HTTP requests per period per user.
6. Enter a value for Authenticated Git HTTP rate limit period in seconds.
7. Select Save changes.

If required, you can allow specific users to bypass authenticated request rate limiting.

Git LFS

Git Large File Storage (LFS) is a Git extension for handling large files. Repositories that use Git LFS can generate a large number of LFS requests. You can enforce general user and IP rate limits, but you can also override the general setting to enforce additional limits on Git LFS requests. This override can improve the security and durability of your web application.

Git LFS on GitLab.com

On GitLab.com, Git LFS requests are subject to authenticated web request rate limits. These limits are set to 1000 requests per minute per user.

Each Git LFS object uploaded or downloaded generates an HTTP request that counts toward this limit.

Configure Git LFS rate limits

Git LFS rate limits are disabled by default on GitLab Self-Managed instances. Administrators can configure dedicated rate limits specifically for Git LFS traffic. When enabled, these dedicated LFS rate limits override the default user and IP rate limits.

Prerequisites:

• You must be an administrator for the instance.

To configure Git LFS rate limits:

1. In the upper-right corner, select Admin.
2. In the left sidebar, select Settings > Network.
3. Expand Git LFS Rate Limits.
4. Select Enable authenticated Git LFS request rate limit.
5. Enter a value for Max authenticated Git LFS requests per period per user.
6. Enter a value for Authenticated Git LFS rate limit period in seconds.
7. Select Save changes.

Git SSH operations

GitLab applies rate limits to Git operations that use SSH by user account and project. When a user exceeds the rate limit, GitLab rejects further connection requests from that user for the project.

The rate limit applies at the Git command (plumbing) level. By default, each command has a rate limit of 600 per minute. For example:

• git push has a rate limit of 600 per minute.
• git pull has its own rate limit of 600 per minute.

The git-upload-pack, git pull, and git clone commands share a rate limit because they share commands.

Limit for each user across all repositories

GitLab also limits the number of Git operations one user can perform across all repositories and Git commands. The limit covers Git SSH operations, pushes over HTTP, and repository changes in the UI or API. By default, each user can perform 6,000 operations each minute. This limit applies in addition to the limit for each project and Git command.

GitLab counts each deploy key separately from the user who created it.

GitLab checks a push over SSH twice: once when the connection is accepted, and once before the changes are written. Each push over SSH counts as two operations. GitLab checks pushes over HTTP and changes in the UI or API once, before the changes are written. When a user is over the limit at that check, GitLab rejects the change after the data is uploaded.

Git SSH operations on GitLab.com

On GitLab.com, Git SSH operations use the default rate limit of 600 operations each minute. The limit for each user across all repositories is 6,000 operations each minute. You cannot change these limits.

Configure the GitLab Shell operation limits

By default, the limit for each user, project, and Git command is 600 operations each minute. The limit across all repositories is 6,000 operations each minute.

Prerequisites:

• Administrator access.

1. In the upper-right corner, select Admin.

2. In the left sidebar, select Settings > Network.

3. Expand Git SSH operations rate limits.

4. Enter values for these fields:

   • Maximum number of Git operations per minute: The limit for each user, project, and Git command.
   • Maximum number of Git operations each user can perform every minute: The limit for each user across all repositories.

   To disable a limit, set it to 0.

5. Select Save changes.

Git push operations

GitLab limits the number of Git pushes to each project every minute. The limit counts pushes from all users, over both HTTPS and SSH. GitLab checks the limit before the client uploads the pushed data. By default, each project accepts 600 pushes each minute. This limit applies in addition to the Git HTTP and Git SSH rate limits.

When a project is over the limit, GitLab returns a 429 Too Many Requests response with a Retry-After header:

• Over HTTPS, the push fails and the Git client shows The requested URL returned error: 429.
• Over SSH, GitLab Shell waits 60 seconds and retries, up to two times. If every attempt is over the limit, the push fails with Internal API unreachable.

The limit counts Git pack uploads to project repositories. It does not count:

• Pushes to wikis or snippets
• Commits made in the UI or API
• Pull mirroring
• Git LFS object uploads

Over HTTPS, a push larger than http.postBuffer (1 MiB by default) counts as two pushes, because Git sends a probe request before the data. Over SSH, a push that uploads Git LFS objects counts as two pushes, because GitLab also counts the Git LFS authentication request.

GitLab counts pushes to a Geo secondary site on the primary site, which receives the data.

Configure the Git push rate limit

Prerequisites:

• Administrator access.

To configure the Git push rate limit:

1. In the upper-right corner, select Admin.
2. In the left sidebar, select Settings > Network.
3. Expand Git push rate limits.
4. Enter a value for Maximum number of pushes every minute for each project. To disable the limit, set it to 0.
5. Select Save changes.

Related topics

• Rate limits
• User and IP rate limits
• Non-configurable rate limits