Pull access denied , repository does not exist or may require 'docker login'

[ravikumar0017]

Describe the bug

Watchtower is unable to pull/access a private repo on azure, config.json is provided.

Steps to reproduce

1. Login to azure : docker login container.azurecr.io --username <username> --password <password>
2. config.json file was generated and stored inside /root/.docker/config.json . Content inside looks like :

{ 
    "auths": {
        "container.azurecr.io": {
            "auth": "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX" 
        }
    }
}

3. Start the watchtower :

docker run -d \
  --name watchtower \
  -v /root/.docker/config.json:/config.json \
  -v /var/run/docker.sock:/var/run/docker.sock \
  containrrr/watchtower  nx \
  --interval 60 \
  --debug

Expected behavior

Watchtower should be able to pull the latest image version successfully

Screenshots

No response

Environment

• Platform : Ubuntu 18.04.5 LTS
• Architecture : linux/amd64
• Docker Version : 20.10.21

Your logs

DEBU[0022] Scheduled next run: 2023-11-01 05:43:53 +0000 UTC
DEBU[0030] Checking containers for updated images
DEBU[0030] Retrieving running containers
DEBU[0030] Trying to load authentication credentials.    container=/nx image="0b6a657795a5:latest"
DEBU[0030] No credentials for index.docker.io found      config_file=/config.json
DEBU[0030] Got image name: 0b6a657795a5:latest
DEBU[0030] Checking if pull is needed                    container=/nx image="0b6a657795a5:latest"
DEBU[0030] Built challenge URL                           URL="https://index.docker.io/v2/"
^CINFO[0030] Waiting for running update to be finished...
DEBU[0030] Got response to challenge request             header="Bearer realm=\"https://auth.docker.io/token\",service=\"registry.docker.io\"" status="401 Unauthorized"
DEBU[0030] Checking challenge header content             realm="https://auth.docker.io/token" service=registry.docker.io
DEBU[0030] Setting scope for auth token                  image=docker.io/library/0b6a657795a5 scope="repository:library/0b6a657795a5:pull"
DEBU[0030] No credentials found.
DEBU[0030] Parsing image ref                             host=index.docker.io image=library/0b6a657795a5 normalized=docker.io/library/0b6a657795a5 tag=latest
DEBU[0030] Doing a HEAD request to fetch a digest        url="https://index.docker.io/v2/library/0b6a657795a5/manifests/latest"
WARN[0031] Could not do a head request for "0b6a657795a5:latest", falling back to regular pull.  container=/nximage="0b6a657795a5:latest"
WARN[0031] Reason: registry responded to head request with "401 Unauthorized", auth: "Bearer realm=\"https://auth.docker.io/token\",service=\"registry.docker.io\",scope=\"repository:library/0b6a657795a5:pull\",error=\"insufficient_scope\""  container=/nx image="0b6a657795a5:latest"
DEBU[0031] Pulling image                                 container=/nx image="0b6a657795a5:latest"
^CDEBU[0032] Error pulling image 0b6a657795a5:latest, Error response from daemon: pull access denied for 0b6a657795a5, repository does not exist or may require 'docker login': denied: requested access to the resource is denied
INFO[0032] Unable to update container "/nx": Error response from daemon: pull access denied for 0b6a657795a5, repository does not exist or may require 'docker login': denied: requested access to the resource is denied. Proceeding to next.
INFO[0032] Session done                                  Failed=0 Scanned=1 Updated=0 notify=no

Additional context

I am able to pull the image manually using command : docker pull container.azurecr.io/nx:master.

Digest: sha256:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
Status: Downloaded newer image for container.azurecr.io/nx:master
container.azurecr.io/nx:master

[piksel]

You need to start your container with a full image name (including the repository). It currently just uses the image named 0b6a657795a5 which contains no information on where to update the image from.

Something like:

docker run container.azurecr.io/nx:master

[ravikumar0017]

@piksel Thanks for the help and quick response.. Yes it resolved the issue.. I was using image Id instead 👍