Google Container Registry access denied when pushing docker container

Question

I try to push my docker container to the google container registry, using this tutorial, but when I run

gcloud docker push b.gcr.io/my-bucket/image-name

I get the error :

The push refers to a repository [b.gcr.io/my-bucket/my-image] (len: 1)
Sending image list
Error: Status 403 trying to push repository my-bucket/my-image: "Access denied."

I couldn't find any more explanation (no -D, --debug, --verbose arguments were recognized), gcloud auth list and docker info tell me I'm connected to both services.

Anything I'm missing ?

score 11 · Answer 1 · edited Jan 30 '22 at 14:28

11

You need to make sure the VM instance has enough access rights. You can set these at the time of creating the instance, or if you have already created the instance, you can also edit it (but first, you'll need to stop the instance). There are two ways to manage this access:

Option 1

Under the Identity and API access, select Allow full access to all Cloud APIs.

Option 2 (recommended)

Under the Identity and API access, select Set access for each API and then choose Read Write for Storage.

Note that you can also change these settings even after you have already created the instance. To do this, you'll first need to stop the instance, and then edit the configuration as mentioned above.

edited Jan 30 '22 at 14:28

The Student Soul

2,272
2
14
12

answered May 22 '17 at 14:34

Yuchen

30,852
26
164
234

I just had to allow full access on all Cloud APIs. Thanks! – DrLime2k10 May 01 '18 at 20:55
Had to spend a lot of time trying to debug this issue. Your solution to allow full access to the Cloud APIs finally solved it. Many thanks! – The Student Soul Jan 27 '22 at 06:21

Richard Corfield · Answer 2 · 2015-09-24T16:13:47.450

4

Use gsutil to check the ACL to make sure you have permission to write to the bucket:

$ gsutil acl get gs://<my-bucket>

You'll need to check which group the account you are using is in ('owners', 'editors', 'viewers' etc.)

EDIT: I have experienced a very similar problem to this myself recently and, as @lampis mentions in his post, it's because the correct permission scopes were not set when I created the VM I was trying to push the image from. Unfortunately there's currently no way of changing the scopes once a VM has been created, so you have to delete the VM (making sure the disks are set to auto-delete!) and recreate the VM with the correct scopes ('compute-rw', 'storage-rw' seems sufficient). It doesn't take long though ;-).

See the --scopes section here: https://cloud.google.com/sdk/gcloud/reference/compute/instances/create

edited Sep 24 '15 at 16:13

answered Jul 06 '15 at 09:50

Richard Corfield

2,489
3
21
24

that's the problem : i'm in the owners group and the owners group members have owners rights on this bucket. Still access denied – hilnius Jul 08 '15 at 16:36
And when you run `gcloud auth list`, the owner that you refer to definitely has `(active)` listed against it? – Richard Corfield Jul 08 '15 at 21:13
Sorry for the delay, SO isn't sending me notifications. Are you using Docker 1.7.0? Docker made a breaking change in 1.7.0 to how they do authentication, but you should try a `gcloud components update`. We updated the docs to include this too: https://cloud.google.com/tools/container-registry/#access_denied – mattmoor Jul 22 '15 at 15:05
I ran into ACL issues, defining the SA user on the bucket ACL's fixed it. – sunshinekitty Mar 11 '17 at 07:29

score 4 · Answer 3 · answered Jun 29 '17 at 02:36

4

I am seeing this but on an intermittent basis. e.g. I may get the error denied: Permission denied for "latest" from request "/v2/...."., but when trying again it will work.

Is anyone else experiencing this?

answered Jun 29 '17 at 02:36

Sam Kenny

395
4
9

1

In my case it actually turned out, I believe, to be a temporary issue in us-central1. – Sam Kenny Jul 07 '17 at 05:06
your comment saved my life. I've chosen another region to push and it worked instantly. Thanks! – Cybratech Jun 22 '22 at 19:00

score 3 · Answer 4 · answered Sep 05 '15 at 09:44

3

For me I forgot to prepend gcloud in the line (and I was wondering how docker would authenticate):

$ gcloud docker push <image>

answered Sep 05 '15 at 09:44

Wernight

36,122
25
118
131

4

this is outdated. gcloud provide auth for docker now. – Jingpeng Wu Feb 01 '19 at 05:33

score 2 · Answer 5 · answered Oct 27 '19 at 02:11

In your terminal, run the code below

$ sudo docker login -u oauth2accesstoken -p "$(gcloud auth print-access-token)" https://[HOSTNAME]

Where -[HOSTNAME] is your container registry location (it is either gcr.io, us.gcr.io, eu.gcr.io, or asia.gcr.io). Check your tagged images to be sure by running $ sudo docker images).

If this doesn't fix it, try reviewing the VM's access scopes.

score 1 · Answer 6 · answered Jul 22 '15 at 16:05

1

If you are using Docker 1.7.0, there was a breaking change to how they handle authentication, which affects users who are using a mix of gcloud docker and docker login.

Be sure you are using the latest version of gcloud via: gcloud components update.

So far this seems to affect gcloud docker, docker-compose and other tools that were reading/writing the Docker auth file.

Hopefully this helps.

answered Jul 22 '15 at 16:05

mattmoor

1,677
14
9

1

Depending on the OS you need to set the user rights accordingly. That means, if you're using `gcloud` without `sudo`, you need to make sure that you can also use the `docker` command without `sodo`. See [here](http://askubuntu.com/a/477554) for more info in case you're using ubuntu. – Randy Nov 09 '16 at 08:50

lampis · Answer 7 · 2015-08-10T19:53:21.473

1

Same problem here, the troubleshooting section from https://cloud.google.com/tools/container-registry/#access_denied wasn't very helpful. I have Docker and GCloud full updated. Don't know what else to do.

BTW, I'm trying to push to "gcr.io".

Fixed. I was using a VM in compute engine as my development machine, and looks like I didn't give it enough rigths in Storage.

edited Aug 10 '15 at 19:53

answered Aug 10 '15 at 17:30

lampis

41
3

Majico · Answer 8 · 2018-03-02T12:46:18.080

0

I had the same problem with access denied and I resolved it with creating new image using Tag:

docker tag IMAGE_WITH_ACCESS_DENIED gcr.io/my-project/my-new-image:test

After that I could PUSH It to Container registry:

gcloud docker -- push gcr.io/my-project/my-new-image:test

edited Mar 02 '18 at 12:46

answered Oct 25 '17 at 16:11

Majico

3,810
2
24
36

score 0 · Answer 9 · answered May 10 '18 at 13:33

0

Today I also got this error inside Jenkins running on Google Kubernetes Engine when pushing the docker container. The reason was a node pool node version upgrade from 1.9.6-gke.1 to 1.9.7-gke.0 in gcp I did before. Worked again after the downgrade.

answered May 10 '18 at 13:33

Techradar

3,506
3
18
28

score 0 · Answer 10 · answered Jul 28 '18 at 21:07

0

You need to login to gcloud from the machine you are:

gcloud auth login

answered Jul 28 '18 at 21:07

Esthon Medeiros

79
1
2
4

Google Container Registry access denied when pushing docker container

10 Answers10

Linked