Yes, maybe embarrassing, but there doesn't seem to be clear documentation on this issue at all: I just signed up for Docker Pro with private repositories. I created a private repository, then tried to push to it. Got the dreaded "denied" message.
Pushing to my public repos worked fine, so I knew I was logged in correctly.
After trying everything related to Docker Hub in the prior 30 answers... I finally understood how private repos work: they're the same as public repos, but with an extra step.
When pushing to a repository - ANY repository within a Docker Hub account - you need to prefix the image:tag
with your username, eg:
given the following values,
username = yourusername
image name = theimage
tag = thetag
1) tag (or commit) the local image, adding a prefix with your username:
docker tag theimage:thetag yourusername/theimage:thetag
Notes:
- if you're in an organization, you need to double prefix the image - like so:
docker tag theimage:thetag yourusername/yourorganizationname/theimage:thetag
- if your tag is
latest
, :thetag
part can be left out; Docker assumes :latest
if you don't enter a :thetag
part
2) push the prefixed image to Docker Hub:
docker push yourusername/theimage:thetag
OR
docker push yourusername/yourorganizationname/theimage:thetag
THE EXTRA STEP:
Either
before step 1 above, create a private repository in your Docker Hub account.
Note that the repository name must be the same as theimage
that you're planning to push. Do not include a thetag
portion on the repository name. Eg, if your image is ubuntu:14.04
, you would name your repository ubuntu
.
Or
if you didn't create the repository in advance (which is not required!): go to your account in Docker Hub; click on the newly pushed repo, then its Settings tab - and make your repo private.
I had seen others with private repos tagging them with the two prefixes, eg xyz/abc/theimage:thetag
, and I thought the 2nd prefix was something I created to mark the repo as private. Nope - that's only for organizations. Removing any 2nd prefix and setting my repo name as just theimage
fixed my denied error!
Another note: each repo holds all the tagged versions of the images with the given repo's name. So, for example, ubuntu:latest
and ubuntu:14.04
, say, will both be in the ubuntu
repo.
Fun With Docker!