Pull access denied
The registry rejected the image download request because the repository is private, does not exist, or requires login credentials.
Usually happens because:
- ☑ Not logged into target registry
- ☑ Typo in image namespace or tag
- ☑ Expired token in ~/.docker/config.json
🔍 Quick Checklist:
What is Pull access denied?
This error occurs when you attempt to pull a container image from a registry (like Docker Hub, GitHub Container Registry, or Amazon ECR) but the registry rejects the download. This typically happens because the image repository is private and you are not logged in, you misspelled the image name or tag, or your active authentication tokens have expired.
Common Causes
- Missing registry authentication: Attempting to download private images without running 'docker login' first.
- Misspelled image repository or tag: Typo in the namespace, image name, or version tag.
- Expired session credentials: Local authentication tokens inside ~/.docker/config.json have expired.
| Cause | Frequency |
|---|---|
| Private repository lookup without login | ⭐⭐⭐⭐⭐ |
| Spelling typo in image name/tag | ⭐⭐⭐⭐ |
| Expired authentication tokens | ⭐⭐⭐ |
Common Mistakes
- Assuming public images never throw this error (Docker Hub enforces anonymous rate limits, which can sometimes manifest as access blocks).
- Using your general password instead of Personal Access Tokens (PAT) when logging into GitHub (GHCR) or GitLab registries.
How to Fix
Docker Operations & Verification
How to authenticate against different container registries.
# Docker Hub
docker login
# GitHub Container Registry (GHCR)
echo $GITHUB_TOKEN | docker login ghcr.io -u username --password-stdin
# GitLab Container Registry
docker login registry.gitlab.comPlatform Specific Fixes
Authenticating using standard CLI pass managers on Linux hosts.
docker login
# Verify tokens written inside user home configs
cat ~/.docker/config.jsonBest Practices
- Utilize Personal Access Tokens (PAT) with read-only scopes inside CI/CD scripts for automated pulling.
- Verify tag formats before releasing build scripts.
Frequently Asked Questions (FAQ)
Q: What does pull access denied mean?
It means the registry server refused to let you download the image, either because it does not exist or because it is private and you don't have authorization.
Q: How do I log in to a custom registry?
Specify the domain name after the command, for example: 'docker login ghcr.io' or 'docker login registry.gitlab.com'.
Q: Can I pull private images in Docker Compose?
Yes, but the host machine running the compose command must be logged in to the target registry beforehand.
Q: Why do I get access denied on public images?
This can happen if you exceed the anonymous pull rate limits on Docker Hub, causing the registry to temporarily reject requests.