diff --git a/__tests__/docker/docker.test.itg.ts b/__tests__/docker/docker.test.itg.ts
new file mode 100644
index 0000000..0cd83be
--- /dev/null
+++ b/__tests__/docker/docker.test.itg.ts
@@ -0,0 +1,56 @@
+/**
+ * Copyright 2024 actions-toolkit authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import {describe, expect, test} from '@jest/globals';
+
+import {Docker} from '../../src/docker/docker';
+
+const maybe = !process.env.GITHUB_ACTIONS || (process.env.GITHUB_ACTIONS === 'true' && process.env.ImageOS && process.env.ImageOS.startsWith('ubuntu')) ? describe : describe.skip;
+
+maybe('pull', () => {
+  // prettier-ignore
+  test.each([
+    [
+      'busybox',
+      undefined,
+    ],
+    [
+      'busybox:1.36',
+      undefined,
+    ],
+    [
+      'busybox@sha256:7ae8447f3a7f5bccaa765926f25fc038e425cf1b2be6748727bbea9a13102094',
+      undefined,
+    ],
+    [
+      'doesnotexist:foo',
+      `pull access denied for doesnotexist`,
+    ],
+  ])('pulling %p', async (image: string, err: string | undefined) => {
+      try {
+        await Docker.pull(image, true);
+        if (err !== undefined) {
+          throw new Error('Expected an error to be thrown');
+        }
+      } catch (e) {
+        if (err === undefined) {
+          throw new Error(`Expected no error, but got: ${e.message}`);
+        }
+        // eslint-disable-next-line jest/no-conditional-expect
+        expect(e.message).toContain(err);
+      }
+    }, 600000);
+});
diff --git a/src/docker/docker.ts b/src/docker/docker.ts
index 4adc756..56dbba3 100644
--- a/src/docker/docker.ts
+++ b/src/docker/docker.ts
@@ -20,7 +20,10 @@ import path from 'path';
 import * as core from '@actions/core';
 import * as io from '@actions/io';
 
+import {Context} from '../context';
+import {Cache} from '../cache';
 import {Exec} from '../exec';
+import {Util} from '../util';
 
 import {ConfigFile} from '../types/docker';
 
@@ -73,4 +76,89 @@ export class Docker {
   public static async printInfo(): Promise<void> {
     await Exec.exec('docker', ['info']);
   }
+
+  public static parseRepoTag(image: string): {repository: string; tag: string} {
+    let sepPos: number;
+    const digestPos = image.indexOf('@');
+    const colonPos = image.lastIndexOf(':');
+    if (digestPos >= 0) {
+      // priority on digest
+      sepPos = digestPos;
+    } else if (colonPos >= 0) {
+      sepPos = colonPos;
+    } else {
+      return {
+        repository: image,
+        tag: 'latest'
+      };
+    }
+    const tag = image.slice(sepPos + 1);
+    if (tag.indexOf('/') === -1) {
+      return {
+        repository: image.slice(0, sepPos),
+        tag: tag
+      };
+    }
+    return {
+      repository: image,
+      tag: 'latest'
+    };
+  }
+
+  public static async pull(image: string, cache?: boolean): Promise<void> {
+    const parsedImage = Docker.parseRepoTag(image);
+    const repoSanitized = parsedImage.repository.replace(/[^a-zA-Z0-9.]+/g, '--');
+    const tagSanitized = parsedImage.tag.replace(/[^a-zA-Z0-9.]+/g, '--');
+
+    const imageCache = new Cache({
+      htcName: repoSanitized,
+      htcVersion: tagSanitized,
+      baseCacheDir: path.join(Docker.configDir, '.cache', 'images', repoSanitized),
+      cacheFile: 'image.tar'
+    });
+
+    let cacheFoundPath: string | undefined;
+    if (cache) {
+      cacheFoundPath = await imageCache.find();
+      if (cacheFoundPath) {
+        core.info(`Image found from cache in ${cacheFoundPath}`);
+        await Exec.getExecOutput(`docker`, ['load', '-i', cacheFoundPath], {
+          ignoreReturnCode: true
+        }).then(res => {
+          if (res.stderr.length > 0 && res.exitCode != 0) {
+            core.warning(`Failed to load image from cache: ${res.stderr.match(/(.*)\s*$/)?.[0]?.trim() ?? 'unknown error'}`);
+          }
+        });
+      }
+    }
+
+    let pulled = true;
+    await Exec.getExecOutput(`docker`, ['pull', image], {
+      ignoreReturnCode: true
+    }).then(res => {
+      pulled = false;
+      if (res.stderr.length > 0 && res.exitCode != 0) {
+        const err = res.stderr.match(/(.*)\s*$/)?.[0]?.trim() ?? 'unknown error';
+        if (cacheFoundPath) {
+          core.warning(`Failed to pull image, using one from cache: ${err}`);
+        } else {
+          throw new Error(err);
+        }
+      }
+    });
+
+    if (cache && pulled) {
+      const imageTarPath = path.join(Context.tmpDir(), `${Util.hash(image)}.tar`);
+      await Exec.getExecOutput(`docker`, ['save', '-o', imageTarPath, image], {
+        ignoreReturnCode: true
+      }).then(async res => {
+        if (res.stderr.length > 0 && res.exitCode != 0) {
+          core.warning(`Failed to save image: ${res.stderr.match(/(.*)\s*$/)?.[0]?.trim() ?? 'unknown error'}`);
+        } else {
+          const cachePath = await imageCache.save(imageTarPath);
+          core.info(`Image cached to ${cachePath}`);
+        }
+      });
+    }
+  }
 }