Answers: <p>@jayooin that's weird, if you use <code>--with-registry-auth</code>, you don't normally have to set up the credentials on each worker node as the credentials are passed to the wokers by the manager.</p>
  <p>In my case the issue was that I was using a self-signed certificate for accessing the private docker registry. I had configured it correctly on the master node, but not on the workers, so connecting to the registry raised a &quot;x509: certificate signed by unknown authority&quot; error on the workers. Fixing the certificate error on the workers solved the issue, without setting up the registry credentials on them.</p>
  
Answers: CC BY-SA 4.0
Answers: 2021-10-20T09:39:44.323Z
Answers: 2021-10-20T09:39:44.323Z
Answers: Mathieu Rollet
Answers: <p>So it turned out that some of the workers didn't have the <strong>correct credentials</strong> to the docker registry. After I applied the correct ones, the command worked normally. </p>
  
  <p>That's weird, since I could do it locally... 
  Anyway, case solved.</p>
  
Answers: CC BY-SA 4.0
Answers: 2019-04-23T06:51:07.073Z
Answers: 2019-04-23T06:51:07.073Z
Answers: jayooin
Body: <p>I'm launching through Ansible (just SSH basically) a docker stack deploy, the issue is also true when launching directly from a <code>manager</code>:</p>
  
  <pre><code>docker stack deploy --prune --with-registry-auth -c /docker/docker-compose.yml "test-stack"
  </code></pre>
  
  <p>I have my credentials to access this registry are defined in <code>.docker/config.json</code>. </p>
  
  <p>The problem is first seen here with a <code>docker stack ps test-stack</code>:</p>
  
  <pre><code> ... Shutdown            Rejected 11 minutes ago      "No such image: myregistry.com:12345/myimage:mytag"
  </code></pre>
  
  <p>The workers aren't uploading the images I want. On their logs, I get the following: </p>
  
  <pre><code>Jan 31 11:22:24 myhost dockerd[1149]: time="2019-01-31T11:22:24.574302458+01:00" level=warning msg="Error getting v2 registry: Get https://myregistry.com:12345/v2/: http: server gave HTTP response to HTTPS client"
  Jan 31 11:22:24 myhost dockerd[1149]: time="2019-01-31T11:22:24.574342640+01:00" level=info msg="Attempting next endpoint for pull after error: Get https://myregistry.com:12345/v2/: http: server gave HTTP response to HTTPS client"
  Jan 31 11:22:24 myhost dockerd[1149]: time="2019-01-31T11:22:24.618063948+01:00" level=info msg="Attempting next endpoint for pull after error: unauthorized: authentication required"
  Jan 31 11:22:24 myhost dockerd[1149]: time="2019-01-31T11:22:24.618121224+01:00" level=error msg="pulling image failed" error="unauthorized: authentication required" module=node/agent/taskmanager node.id=rarbt9afb16y7j77bfwiacby2 service.id=ej4y7wbwp539u7mmmhfashz93 task.id=c1uy2gnwdcmibp6l2p9rfxcsh
  Jan 31 11:22:24 myhost dockerd[1149]: time="2019-01-31T11:22:24.618840324+01:00" level=error msg="fatal task error" error="No such image: myregistry.com:12345/myimage:mytag" module=node/agent/taskmanager node.id=rarbt9afb16y7j77bfwiacby2 service.id=ej4y7wbwp539u7mmmhfashz93 task.id=c1uy2gnwdcmibp6l2p9rfxcsh
  Jan 31 11:22:29 myhost dockerd[1149]: time="2019-01-31T11:22:29.548642584+01:00" level=warning msg="failed to deactivate service binding for container test-stack_myservice.1.c1uy2gnwdcmibp6l2p9rfxcsh" error="No such container: test-stack_myservice.1.c1uy2gnwdcmibp6l2p9rfxcsh" module=node/agent node.id=rarbt9afb16y7j77bfwiacby2
  </code></pre>
  
  <p><strong>The problem</strong> is that, when I do a <code>docker pull myregistry.com:12345/myimage:mytag</code> on the workers, it pulls the image successfully and without any problem, but not through an <code>docker stack deploy</code> command. Despite the fact that i have the option <code>--with-registry-auth</code>.</p>
  
Tags: <docker><docker-compose><docker-swarm><docker-registry>
Title: Docker stack deploy doesn't pull images
UserDisplayName: jayooin
ThreadText: # Docker stack deploy doesn't pull images
  
  (Asked by: username_0 on 2019-01-31)
  
  I'm launching through Ansible (just SSH basically) a docker stack deploy, the issue is also true when launching directly from a `manager`:
  
  ```
  docker stack deploy --prune --with-registry-auth -c /docker/docker-compose.yml "test-stack"
  
  ```
  
  I have my credentials to access this registry are defined in `.docker/config.json`.
  
  The problem is first seen here with a `docker stack ps test-stack`:
  
  ```
   ... Shutdown            Rejected 11 minutes ago      "No such image: myregistry.com:12345/myimage:mytag"
  
  ```
  
  The workers aren't uploading the images I want. On their logs, I get the following:
  
  ```
  Jan 31 11:22:24 myhost dockerd[1149]: time="2019-01-31T11:22:24.574302458+01:00" level=warning msg="Error getting v2 registry: Get https://myregistry.com:12345/v2/: http: server gave HTTP response to HTTPS client"
  Jan 31 11:22:24 myhost dockerd[1149]: time="2019-01-31T11:22:24.574342640+01:00" level=info msg="Attempting next endpoint for pull after error: Get https://myregistry.com:12345/v2/: http: server gave HTTP response to HTTPS client"
  Jan 31 11:22:24 myhost dockerd[1149]: time="2019-01-31T11:22:24.618063948+01:00" level=info msg="Attempting next endpoint for pull after error: unauthorized: authentication required"
  Jan 31 11:22:24 myhost dockerd[1149]: time="2019-01-31T11:22:24.618121224+01:00" level=error msg="pulling image failed" error="unauthorized: authentication required" module=node/agent/taskmanager node.id=rarbt9afb16y7j77bfwiacby2 service.id=ej4y7wbwp539u7mmmhfashz93 task.id=c1uy2gnwdcmibp6l2p9rfxcsh
  Jan 31 11:22:24 myhost dockerd[1149]: time="2019-01-31T11:22:24.618840324+01:00" level=error msg="fatal task error" error="No such image: myregistry.com:12345/myimage:mytag" module=node/agent/taskmanager node.id=rarbt9afb16y7j77bfwiacby2 service.id=ej4y7wbwp539u7mmmhfashz93 task.id=c1uy2gnwdcmibp6l2p9rfxcsh
  Jan 31 11:22:29 myhost dockerd[1149]: time="2019-01-31T11:22:29.548642584+01:00" level=warning msg="failed to deactivate service binding for container test-stack_myservice.1.c1uy2gnwdcmibp6l2p9rfxcsh" error="No such container: test-stack_myservice.1.c1uy2gnwdcmibp6l2p9rfxcsh" module=node/agent node.id=rarbt9afb16y7j77bfwiacby2
  
  ```
  
  **The problem** is that, when I do a `docker pull myregistry.com:12345/myimage:mytag` on the workers, it pulls the image successfully and without any problem, but not through an `docker stack deploy` command. Despite the fact that i have the option `--with-registry-auth`.
  
  **Tags:** docker, docker-compose, docker-swarm, docker-registry
  
  
  ---
  
  ## 2 answers
  
  ### Answer by username_0 on 2019-04-23. Score: 4 | Accepted answer
  
  So it turned out that some of the workers didn't have the **correct credentials** to the docker registry. After I applied the correct ones, the command worked normally.
  
  That's weird, since I could do it locally...
  Anyway, case solved.
  
  
  ---
  
  ### Answer by username_1 on 2021-10-20. Score: 1
  
  @username_0 that's weird, if you use `--with-registry-auth`, you don't normally have to set up the credentials on each worker node as the credentials are passed to the wokers by the manager.
  
  In my case the issue was that I was using a self-signed certificate for accessing the private docker registry. I had configured it correctly on the master node, but not on the workers, so connecting to the registry raised a "x509: certificate signed by unknown authority" error on the workers. Fixing the certificate error on the workers solved the issue, without setting up the registry credentials on them.
  
  
  ---
  
  