<p>It looks like that the <code>docker login</code> and the <code>docker build</code> were done by different users. If a <code>docker login</code> is performed, then a <code>~/.docker</code> directory will be created in the namespace of user X, if the build is done by user Y then the latter user does not have a .docker folder and is not authorized to pull the image. One could verify this by <code>echo $USER</code> in the pipeline, in this case gitlab-ci.yaml to check this. </p>

CC BY-SA 4.0
2019-08-25T08:53:48.930Z
I tried to put the *echo $USER* in the .gitlab-ci.yml but it doesn't print anything. I tried to change the base image from *FROM gitlab.mycompany.dk/alpine-ruby-service-base* to docker hub public repository and it works. I checked the ~/.docker directory and all the registry login details are there.
CodeWeed
CC BY-SA 4.0
2019-08-07T15:31:56.280Z
2019-08-07T15:31:56.280Z
030
<p>This could also be happening if you perform a <code>docker login</code> before the <code>docker pull</code> in a gitlab runnner as instructed if:</p>
<p>Your shell runner is configured to run multiple builds and all the builds share the same home directory /home/gitlab-runner-username. Per default <code>docker login</code> saves the credentials in ~/.docker/config.json. When there is multiple build jobs running the second build job may overwrite the credentials of the first one. When the second one is triggered by a different user or finishes before the first one, the first one may get the <code>denied:  requested access to the resource is denied</code> message even tough you logged in properly.</p>
<p>On our servers i solved this by using a custom <a href="https://gist.github.com/ap-wtioit/5e8379a1acc74affffe15f754ef1f6e1" rel="nofollow noreferrer">credentials script</a> that does not store the credentials in a shared file but uses the credentials present in the <a href="https://docs.gitlab.com/ee/ci/variables/predefined_variables.html" rel="nofollow noreferrer">gitlab ci job environment</a></p>

CC BY-SA 4.0
2021-01-22T08:34:10.120Z
2021-01-22T08:34:10.120Z
bigbear3001
<p>I have built a custom base image from alpine and use it as the base for ruby services that we develop.</p>

<pre><code>FROM ruby:2.4.2-alpine
...
</code></pre>

<p>I use Gitlab and Gitlab's docker registry along with it. Each project has its own docker image storage. </p>

<p>I created a separate project for the <strong>alpine-ruby-service</strong> dockerfile. Then build and pushed the image to Gitlab.</p>

<p>In the ruby service project docker images, I reference it as follows</p>

<pre><code>FROM gitlab.mycompany.dk/alpine-ruby-service-base
...
</code></pre>

<p>I have a CI/CD pipeline (.gitlab-ci.yaml) which builds these ruby service images when there is a commit to one of the branches. </p>

<p>The problem is that when the CI/CD pipeline is run it fails with the following message </p>

<pre><code> $ docker build --pull -t $CONTAINER_TEST_IMAGE .
   Sending build context to Docker daemon  709.6kB

 Step 1/13 : FROM gitlab.mycompany.dk:xxxx/alpine-ruby-service-base
 pull access denied for gitlab.mycompany.dk:xxxx/alpine-ruby-service-base,
 repository does not exist or may require 'docker login': denied: 
 requested access to the resource is denied
</code></pre>

<p>I have an instruction to login to the Gitlab docker registry before the build command above using </p>

<pre><code> docker login --username=gitlab-ci-token --password=$CI_JOB_TOKEN gitlab.mycompany.dk:xxxx
</code></pre>

<p>the login succeeds but the following docker build instruction fails!!! can someone point me what is going wrong?</p>

<docker><gitlab><cicd><docker-registry>
Gitlab CI/CD fails to build docker image
CodeWeed
# Gitlab CI/CD fails to build docker image

(Asked by: username_0 on 2019-08-06)

I have built a custom base image from alpine and use it as the base for ruby services that we develop.
FROM ruby:2.4.2-alpine
...

I use Gitlab and Gitlab's docker registry along with it. Each project has its own docker image storage. 
I created a separate project for the alpine-ruby-service dockerfile. Then build and pushed the image to Gitlab.
In the ruby service project docker images, I reference it as follows
FROM gitlab.mycompany.dk/alpine-ruby-service-base
...

I have a CI/CD pipeline (.gitlab-ci.yaml) which builds these ruby service images when there is a commit to one of the branches. 
The problem is that when the CI/CD pipeline is run it fails with the following message 
 $ docker build --pull -t $CONTAINER_TEST_IMAGE .
   Sending build context to Docker daemon  709.6kB

 Step 1/13 : FROM gitlab.mycompany.dk:xxxx/alpine-ruby-service-base
 pull access denied for gitlab.mycompany.dk:xxxx/alpine-ruby-service-base,
 repository does not exist or may require 'docker login': denied: 
 requested access to the resource is denied

I have an instruction to login to the Gitlab docker registry before the build command above using 
 docker login --username=gitlab-ci-token --password=$CI_JOB_TOKEN gitlab.mycompany.dk:xxxx

the login succeeds but the following docker build instruction fails!!! can someone point me what is going wrong?

**Tags:** docker, gitlab, cicd, docker-registry


---

## 2 answers

### Answer by username_1 on 2019-08-07. Score: 2

It looks like that the `docker login` and the `docker build` were done by different users. If a `docker login` is performed, then a `~/.docker` directory will be created in the namespace of user X, if the build is done by user Y then the latter user does not have a .docker folder and is not authorized to pull the image. One could verify this by `echo $USER` in the pipeline, in this case gitlab-ci.yaml to check this.

> **Comments:**
> **username_0**: I tried to put the *echo $USER* in the .gitlab-ci.yml but it doesn't print anything. I tried to change the base image from *FROM gitlab.mycompany.dk/alpine-ruby-service-base* to docker hub public repository and it works. I checked the ~/.docker directory and all the registry login details are there.  

---

### Answer by username_2 on 2021-01-22. Score: 0

This could also be happening if you perform a `docker login` before the `docker pull` in a gitlab runnner as instructed if:

Your shell runner is configured to run multiple builds and all the builds share the same home directory /home/gitlab-runner-username. Per default `docker login` saves the credentials in ~/.docker/config.json. When there is multiple build jobs running the second build job may overwrite the credentials of the first one. When the second one is triggered by a different user or finishes before the first one, the first one may get the `denied: requested access to the resource is denied` message even tough you logged in properly.

On our servers i solved this by using a custom [credentials script](https://gist.github.com/ap-wtioit/5e8379a1acc74affffe15f754ef1f6e1) that does not store the credentials in a shared file but uses the credentials present in the [gitlab ci job environment](https://docs.gitlab.com/ee/ci/variables/predefined_variables.html)


---

