<p>From the <a href="https://cloud.google.com/container-registry/docs/pushing-and-pulling#before_you_begin" rel="nofollow noreferrer">Before you begin</a> section of the instructions you referenced:</p>

<blockquote>
  <p>Make sure that you:</p>
  
  <ol start="3">
  <li>Have <a href="https://cloud.google.com/container-registry/docs/access-control" rel="nofollow noreferrer">access to the registries</a> which you will be pushing to and pulling from</li>
  </ol>
</blockquote>

<p>This is specified in more details in <a href="https://cloud.google.com/container-registry/docs/using-with-google-cloud-platform" rel="nofollow noreferrer">Using Container Registry with Google Cloud Platform</a>:</p>

<blockquote>
  <p>To push private Docker images from a Compute Engine instance, your
  instance must have <a href="https://cloud.google.com/storage/docs/authentication#oauth" rel="nofollow noreferrer"><code>read-write</code> or <code>full-control</code> permission</a> to
  the image's bucket.</p>
</blockquote>

<p>So the GCS bucket corresponding to <code>gcr.io</code> (or whichever GCR domain you want to use) and the desired cloud project must already be created and your GCE instance's service account must have the necessary <a href="https://cloud.google.com/container-registry/docs/access-control#permissions_and_roles" rel="nofollow noreferrer">role/permissions</a> for push operations.</p>

<p>It's true, the instructions you referenced mention in <a href="https://cloud.google.com/container-registry/docs/pushing-and-pulling#push_the_tagged_image_to_product_name_short" rel="nofollow noreferrer">Push the tagged image to Container Registry</a>:</p>

<blockquote>
  <p>When you push an image to a registry with a new hostname, Container
  Registry creates a storage bucket in the specified <a href="https://cloud.google.com/storage/docs/bucket-locations#location-mr" rel="nofollow noreferrer">multi-regional
  location</a>.</p>
</blockquote>

<p>So I believe you'd have to:</p>

<ul>
<li>first create create the bucket by executing a push to the desired GCR domain and project, but: 

<ul>
<li>from your own computer (or some machine which is not a GCE instance, but YMMV)</li>
<li>using the credentials of an acceptable identity, not the GCE instance service account's ones. I'd try with a real user credentials, I'm not sure if a service account's ones would cut it.</li>
</ul></li>
<li>after the bucket is created add to its access control the GCE instance service account's role/permissions for push operations</li>
<li>then perform pushes from the GCE instance</li>
</ul>

CC BY-SA 4.0
2018-10-20T21:34:08.050Z
Thank you Dan. Unfortunately, that didn't work (I tried what you suggested). I granted the service-user permissions on the bucket: "Storage Admin" and even granted the IAM service account with: "Compute Storage Admin" and "Storage Admin". I made sure that Billing is also configured properly. Still, the push cannot be done with the service account from the service account instance
orberkov
CC BY-SA 4.0
2018-10-21T18:28:29.493Z
The ONLY way I was able to push the containers eventually, was using my personal account on GCE. I can't seem to perform the operation using a service account, not matter what privileges I give it
orberkov
CC BY-SA 4.0
2018-10-20T16:52:01.047Z
2018-10-20T16:52:01.047Z
Dan Cornilescu
<p>I faced this same problem when I was trying to automate GCP kubernetes deployment using Jenkins by putting image in GCR and I created one service account giving admin permission in gcp IAM. </p>

<p>I launched one VM giving same IAM service account access.</p>

<p>I installed gcloud sdk using <a href="https://cloud.google.com/sdk/docs/quickstart-debian-ubuntu" rel="nofollow noreferrer">here</a> follows below command.</p>

<p>$gcloud init</p>

<p>$gcloud auth configure-docker</p>

<p>$cd my_api &amp;&amp; docker build --no-cache -t my_api .</p>

<p>$docker tag my_api asia.gcr.io/firebase-mytalk/my_api:latest</p>

<p>$gcloud docker -- push asia.gcr.io/firebase-mytalk/my_api:latest</p>

CC BY-SA 4.0
2018-12-21T14:20:37.240Z
what do you mean "admin permission in gcp" ? to which service in gcp?
orberkov
CC BY-SA 4.0
2018-12-24T09:28:45.183Z
project permission as admin
ShreePool
CC BY-SA 4.0
2018-12-20T06:16:06.413Z
2018-12-20T06:16:06.413Z
ShreePool
<p>I created a new VM instance on my GCE compute engine (I have Owner permissions). On that instance, I installed git, docker, and gcloud - everything is done under <code>sudo su</code>. </p>

<p>I was hoping I can use that VM instance to deploy images to GCR, but whatever I do - <strong>I cannot seem to have sufficient permissions to push</strong> the images from that instance. </p>

<ol>
<li>I granted "Storage Admin" along with the "Editor" permissions to the VM Instance (autogenerated) IAM service-account.</li>
<li>When I run <code>docker login eu.gcr.io</code> I receive <code>Login Succeeded</code> with no problems. </li>
<li>I copied both a p12 key and a .json key to the .ssh folder (I generated them on the IAM console) - but that had no use too.</li>
<li><p>To tag and push the docker image, I <a href="https://cloud.google.com/container-registry/docs/pushing-and-pulling" rel="nofollow noreferrer">use this:</a>: </p>

<p>docker tag [SOURCE_IMAGE] [HOSTNAME]/[PROJECT-ID]/[IMAGE]</p></li>
</ol>

<p>and</p>

<pre><code>docker push [HOSTNAME]/[PROJECT-ID]/[IMAGE]
</code></pre>

<p>Notice: It seems that at this stage (2018) <code>gcloud docker -- push</code> is obsolete (and it didn't work for me as well...) </p>

<p>Notice: The bucket is NOT created yet, so setting permissions on the Storage console is out of the question at this point.</p>

<p>What could be the reason for the Permission Denied problem ?</p>

<docker><google-compute-engine><registry>
Why am I unable to push docker image in gce (gcr.io)?
orberkov
# Why am I unable to push docker image in gce (gcr.io)?

(Asked by: username_0 on 2018-10-19)

I created a new VM instance on my GCE compute engine (I have Owner permissions). On that instance, I installed git, docker, and gcloud - everything is done under sudo su. 
I was hoping I can use that VM instance to deploy images to GCR, but whatever I do - I cannot seem to have sufficient permissions to push the images from that instance. 

I granted "Storage Admin" along with the "Editor" permissions to the VM Instance (autogenerated) IAM service-account.
When I run docker login eu.gcr.io I receive Login Succeeded with no problems. 
I copied both a p12 key and a .json key to the .ssh folder (I generated them on the IAM console) - but that had no use too.
To tag and push the docker image, I use this:: 
docker tag [SOURCE_IMAGE] [HOSTNAME]/[PROJECT-ID]/[IMAGE]

and
docker push [HOSTNAME]/[PROJECT-ID]/[IMAGE]

Notice: It seems that at this stage (2018) gcloud docker -- push is obsolete (and it didn't work for me as well...) 
Notice: The bucket is NOT created yet, so setting permissions on the Storage console is out of the question at this point.
What could be the reason for the Permission Denied problem ?

**Tags:** docker, google-compute-engine, registry


---

## 2 answers

### Answer by username_1 on 2018-10-20. Score: 1

From the [Before you begin](https://cloud.google.com/container-registry/docs/pushing-and-pulling#before_you_begin) section of the instructions you referenced:

> Make sure that you:
>
> 3. Have [access to the registries](https://cloud.google.com/container-registry/docs/access-control) which you will be pushing to and pulling from

This is specified in more details in [Using Container Registry with Google Cloud Platform](https://cloud.google.com/container-registry/docs/using-with-google-cloud-platform):

> To push private Docker images from a Compute Engine instance, your
> instance must have [`read-write` or `full-control` permission](https://cloud.google.com/storage/docs/authentication#oauth) to
> the image's bucket.

So the GCS bucket corresponding to `gcr.io` (or whichever GCR domain you want to use) and the desired cloud project must already be created and your GCE instance's service account must have the necessary [role/permissions](https://cloud.google.com/container-registry/docs/access-control#permissions_and_roles) for push operations.

It's true, the instructions you referenced mention in [Push the tagged image to Container Registry](https://cloud.google.com/container-registry/docs/pushing-and-pulling#push_the_tagged_image_to_product_name_short):

> When you push an image to a registry with a new hostname, Container
> Registry creates a storage bucket in the specified [multi-regional
> location](https://cloud.google.com/storage/docs/bucket-locations#location-mr).

So I believe you'd have to:

* first create create the bucket by executing a push to the desired GCR domain and project, but:
  + from your own computer (or some machine which is not a GCE instance, but YMMV)
  + using the credentials of an acceptable identity, not the GCE instance service account's ones. I'd try with a real user credentials, I'm not sure if a service account's ones would cut it.
* after the bucket is created add to its access control the GCE instance service account's role/permissions for push operations
* then perform pushes from the GCE instance

> **Comments:**
> **username_0**: Thank you Dan. Unfortunately, that didn't work (I tried what you suggested). I granted the service-user permissions on the bucket: "Storage Admin" and even granted the IAM service account with: "Compute Storage Admin" and "Storage Admin". I made sure that Billing is also configured properly. Still, the push cannot be done with the service account from the service account instance  
> **username_0**: The ONLY way I was able to push the containers eventually, was using my personal account on GCE. I can't seem to perform the operation using a service account, not matter what privileges I give it  

---

### Answer by username_2 on 2018-12-20. Score: 1

I faced this same problem when I was trying to automate GCP kubernetes deployment using Jenkins by putting image in GCR and I created one service account giving admin permission in gcp IAM.

I launched one VM giving same IAM service account access.

I installed gcloud sdk using [here](https://cloud.google.com/sdk/docs/quickstart-debian-ubuntu) follows below command.

$gcloud init

$gcloud auth configure-docker

$cd my\_api && docker build --no-cache -t my\_api .

$docker tag my\_api asia.gcr.io/firebase-mytalk/my\_api:latest

$gcloud docker -- push asia.gcr.io/firebase-mytalk/my\_api:latest

> **Comments:**
> **username_0**: what do you mean "admin permission in gcp" ? to which service in gcp?  
> **username_2**: project permission as admin  

---

