I want to pull a Docker image from a private artifatory but keep getting an AuthorizationFailure. I am using a shared account to login to the artifactory which works flawlessly for other users (Windows and Linux).
These are my system details
OS: Ubuntu 22.04.4 LTSDocker: 26.0.0, build 2ae903eVPN connection: OpenVPN 2.5.9Im am not using a key store at the moment so this is what my ~/.docker/config.json looks like:
{"auths": {"some-artifactory.private.com": {"auth": "dGhpcyBpcyB3aWxsIGJlIGVuY29kZWQgYWJlIDEyODM5MDQ1IHNjaGlicXdvZm9qY2FvCg==" } }}Here is what I am doing or rather fail to do:
$ docker login some-artifactory.private.comAuthenticating with existing credentials...WARNING! Your password will be stored unencrypted in /home/mkay/.docker/config.json.Configure a credential helper to remove this warning. Seehttps://docs.docker.com/engine/reference/commandline/login/#credentials-storeLogin SucceededIn the Docker console I see these lines when I run the login command:
DEBU[2024-04-04T11:48:20.483845436+02:00] Calling GET /events spanID=037a2fcc6ecf8813 traceID=80951f416479b11787f7315a395a580dDEBU[2024-04-04T12:10:00.156720952+02:00] Calling HEAD /_ping spanID=f118694db2547d5e traceID=6565c5b2d28d026c0bb05acf7063269eDEBU[2024-04-04T12:10:00.157099515+02:00] Calling POST /v1.45/auth spanID=f76caa9ef9687a4c traceID=3e88c0f2fc1bcad271120a07d975ac6eDEBU[2024-04-04T12:10:00.157144033+02:00] form data: {"password":"*****","serveraddress":"some-artifactory.private.com","username":"developer"} spanID=f76caa9ef9687a4c traceID=3e88c0f2fc1bcad271120a07d975ac6eDEBU[2024-04-04T12:10:13.077266492+02:00] hostDir: /etc/docker/certs.d/some-artifactory.private.com DEBU[2024-04-04T12:10:13.077360953+02:00] attempting v2 login to registry endpoint https://some-artifactory.private.com/v2/Here I don't see anything that would indicate that the login attempt was successful.
Next I try to pull the image I need:
$ docker --debug pull some-artifactory.private.com/dockerimages/library/openjdk@sha256:21b85bfe97b6e6c3945215f058daaf75019a1aec46a96584d08bb69abfbf27cesome-artifactory.private.com/dockerimages/library/openjdk@sha256:21b85bfe97b6e6c3945215f058daaf75019a1aec46a96584d08bb69abfbf27ce: Pulling from dockerimages/library/openjdk5843afab3874: Pulling fs layer 53c9466125e4: Waiting d8d715783b80: Waiting error pulling image configuration: download failed after attempts=1: denied: <?xml version="1.0" encoding="utf-8"?><Error><Code>AuthorizationFailure</Code><Message>This request is not authorized to perform this operation.RequestId:0a9ce0aa-a01e-0043-4678-860656000000Time:2024-04-04T10:14:58.7988881Z</Message></Error>In the Docker log the output for the pull request looks like this:
DEBU[2024-04-04T12:14:45.204112896+02:00] Calling HEAD /_ping spanID=23aecbe59ff025f8 traceID=337ccc80bc6e7b62ba149666772a4579DEBU[2024-04-04T12:14:45.205156860+02:00] Calling POST /v1.45/images/create?fromImage=some-artifactory.private.com%2Fdockerimages%2Flibrary%2Fopenjdk&tag=sha256%3A21b85bfe97b6e6c3945215f058daaf75019a1aec46a96584d08bb69abfbf27ce spanID=bf22c579f928e94c traceID=7a9ad57eea4a21d95de8fcd95241e055DEBU[2024-04-04T12:14:46.646507985+02:00] hostDir: /etc/docker/certs.d/some-artifactory.private.com DEBU[2024-04-04T12:14:46.646608252+02:00] Trying to pull some-artifactory.private.com/dockerimages/library/openjdk from https://some-artifactory.private.com spanID=bf22c579f928e94c traceID=7a9ad57eea4a21d95de8fcd95241e055DEBU[2024-04-04T12:14:46.646655649+02:00] Trying to pull some-artifactory.private.com/dockerimages/library/openjdk from https://some-artifactory.private.com spanID=bf22c579f928e94c traceID=7a9ad57eea4a21d95de8fcd95241e055WARN[2024-04-04T12:14:51.906649521+02:00] reference for unknown type: digest="sha256:21b85bfe97b6e6c3945215f058daaf75019a1aec46a96584d08bb69abfbf27ce" remote="some-artifactory.private.com/dockerimages/library/openjdk@sha256:21b85bfe97b6e6c3945215f058daaf75019a1aec46a96584d08bb69abfbf27ce" spanID=bf22c579f928e94c traceID=7a9ad57eea4a21d95de8fcd95241e055DEBU[2024-04-04T12:14:51.916308809+02:00] Fetching manifest from remote digest="sha256:21b85bfe97b6e6c3945215f058daaf75019a1aec46a96584d08bb69abfbf27ce" error="<nil>" remote="some-artifactory.private.com/dockerimages/library/openjdk@sha256:21b85bfe97b6e6c3945215f058daaf75019a1aec46a96584d08bb69abfbf27ce" spanID=bf22c579f928e94c traceID=7a9ad57eea4a21d95de8fcd95241e055DEBU[2024-04-04T12:14:57.454167925+02:00] Pulling ref from V2 registry: some-artifactory.private.com/dockerimages/library/openjdk@sha256:21b85bfe97b6e6c3945215f058daaf75019a1aec46a96584d08bb69abfbf27ce digest="sha256:21b85bfe97b6e6c3945215f058daaf75019a1aec46a96584d08bb69abfbf27ce" remote="some-artifactory.private.com/dockerimages/library/openjdk@sha256:21b85bfe97b6e6c3945215f058daaf75019a1aec46a96584d08bb69abfbf27ce" spanID=bf22c579f928e94c traceID=7a9ad57eea4a21d95de8fcd95241e055DEBU[2024-04-04T12:14:57.454207979+02:00] some-artifactory.private.com/dockerimages/library/openjdk@sha256:21b85bfe97b6e6c3945215f058daaf75019a1aec46a96584d08bb69abfbf27ce resolved to a manifestList object with 1 entries; looking for a unknown match digest="sha256:21b85bfe97b6e6c3945215f058daaf75019a1aec46a96584d08bb69abfbf27ce" remote="some-artifactory.private.com/dockerimages/library/openjdk@sha256:21b85bfe97b6e6c3945215f058daaf75019a1aec46a96584d08bb69abfbf27ce" spanID=bf22c579f928e94c traceID=7a9ad57eea4a21d95de8fcd95241e055DEBU[2024-04-04T12:14:57.454224670+02:00] found match for linux/amd64/v4 with media type application/vnd.docker.distribution.manifest.v2+json, digest sha256:a996cdcc040704ec6badaf5fecf1e144c096e00231a29188596c784bcf858d05 DEBU[2024-04-04T12:14:57.461564403+02:00] Fetching manifest from remote digest="sha256:21b85bfe97b6e6c3945215f058daaf75019a1aec46a96584d08bb69abfbf27ce" error="<nil>" remote="some-artifactory.private.com/dockerimages/library/openjdk@sha256:21b85bfe97b6e6c3945215f058daaf75019a1aec46a96584d08bb69abfbf27ce" spanID=bf22c579f928e94c traceID=7a9ad57eea4a21d95de8fcd95241e055DEBU[2024-04-04T12:14:57.966715998+02:00] pulling blob "sha256:5843afab387455b37944e709ee8c78d7520df80f8d01cf7f861aae63beeddb6b" ERRO[2024-04-04T12:14:58.823396393+02:00] Not continuing with pull after error: error pulling image configuration: download failed after attempts=1: denied: <?xml version="1.0" encoding="utf-8"?><Error><Code>AuthorizationFailure</Code><Message>This request is not authorized to perform this operation.RequestId:0a9ce0aa-a01e-0043-4678-860656000000Time:2024-04-04T10:14:58.7988881Z</Message></Error> spanID=bf22c579f928e94c traceID=7a9ad57eea4a21d95de8fcd95241e055For reference, when I manipulate the auth content in my config.json and run the pull again the log output looks different. This confirms to me that the config.json is actually used and I am authorized at least at some point.
DEBU[2024-04-04T12:58:04.299743609+02:00] Calling HEAD /_ping spanID=7ab48f2836ca8e0e traceID=49b60bc8cc4d4206ea6fd6cd187b69f7DEBU[2024-04-04T12:58:04.300869280+02:00] Calling POST /v1.45/images/create?fromImage=some-artifactory.private.com%2Fdockerimages%2Flibrary%2Fopenjdk&tag=sha256%3A21b85bfe97b6e6c3945215f058daaf75019a1aec46a96584d08bb69abfbf27ce spanID=f903e0eafdcf0a79 traceID=694af69a590ef3a4013436a960b49250DEBU[2024-04-04T12:58:11.000291841+02:00] hostDir: /etc/docker/certs.d/some-artifactory.private.com DEBU[2024-04-04T12:58:11.000388276+02:00] Trying to pull some-artifactory.private.com/dockerimages/library/openjdk from https://some-artifactory.private.com spanID=f903e0eafdcf0a79 traceID=694af69a590ef3a4013436a960b49250DEBU[2024-04-04T12:58:11.000437057+02:00] Trying to pull some-artifactory.private.com/dockerimages/library/openjdk from https://some-artifactory.private.com spanID=f903e0eafdcf0a79 traceID=694af69a590ef3a4013436a960b49250WARN[2024-04-04T12:58:11.240779597+02:00] reference for unknown type: digest="sha256:21b85bfe97b6e6c3945215f058daaf75019a1aec46a96584d08bb69abfbf27ce" remote="some-artifactory.private.com/dockerimages/library/openjdk@sha256:21b85bfe97b6e6c3945215f058daaf75019a1aec46a96584d08bb69abfbf27ce" spanID=f903e0eafdcf0a79 traceID=694af69a590ef3a4013436a960b49250DEBU[2024-04-04T12:58:11.250452268+02:00] Fetching manifest from remote digest="sha256:21b85bfe97b6e6c3945215f058daaf75019a1aec46a96584d08bb69abfbf27ce" error="<nil>" remote="some-artifactory.private.com/dockerimages/library/openjdk@sha256:21b85bfe97b6e6c3945215f058daaf75019a1aec46a96584d08bb69abfbf27ce" spanID=f903e0eafdcf0a79 traceID=694af69a590ef3a4013436a960b49250ERRO[2024-04-04T12:58:11.784489162+02:00] Not continuing with pull after error: unauthorized: unauthorized to access repository: dockerimages/library/openjdk, action: pull: unauthorized to access repository: dockerimages/library/openjdk, action: pull spanID=f903e0eafdcf0a79 traceID=694af69a590ef3a4013436a960b49250ERRO[2024-04-04T12:58:11.788397410+02:00] Handler for POST /v1.45/images/create returned error: unauthorized: unauthorized to access repository: dockerimages/library/openjdk, action: pull: unauthorized to access repository: dockerimages/library/openjdk, action: pull spanID=f903e0eafdcf0a79 traceID=694af69a590ef3a4013436a960b49250So far I have done the following to overcome the AuthorizationFailure:
- Login/logout of the docker artifactory some-artifactory.private.com
- Delete the ~/.docker/config.json and have it recreated with a new docker login to some-artifactory.private.com
- Stop and restart docker
- Temporarily stopped anti-virus programms
- Stopped and restarted openvpn
- Uninstall and reinstall of docker and its libraries
- Update/upgrade of my Ubuntu packages
- Restart the system
- Used a different account (with pull rights on all images) to access artifactory some-artifactory.private.com
All to no avail. I just keep getting the AuthorizationFailure. At this point i am basically clueless. Is there anyone who encountered this problem and managed to resolve it or has any suggestions as to what else I could try?