Answers: <p>It looks like that the <code>docker login</code> and the <code>docker build</code> were done by different users. If a <code>docker login</code> is performed, then a <code>~/.docker</code> directory will be created in the namespace of user X, if the build is done by user Y then the latter user does not have a .docker folder and is not authorized to pull the image. One could verify this by <code>echo $USER</code> in the pipeline, in this case gitlab-ci.yaml to check this. </p>
  
Answers: CC BY-SA 4.0
Answers: 2019-08-25T08:53:48.930Z
Answers: I tried to put the *echo $USER* in the .gitlab-ci.yml but it doesn't print anything. I tried to change the base image from *FROM gitlab.mycompany.dk/alpine-ruby-service-base* to docker hub public repository and it works. I checked the ~/.docker directory and all the registry login details are there.
Answers: CodeWeed
Answers: CC BY-SA 4.0
Answers: 2019-08-07T15:31:56.280Z
Answers: 2019-08-07T15:31:56.280Z
Answers: 030
Answers: <p>This could also be happening if you perform a <code>docker login</code> before the <code>docker pull</code> in a gitlab runnner as instructed if:</p>
  <p>Your shell runner is configured to run multiple builds and all the builds share the same home directory /home/gitlab-runner-username. Per default <code>docker login</code> saves the credentials in ~/.docker/config.json. When there is multiple build jobs running the second build job may overwrite the credentials of the first one. When the second one is triggered by a different user or finishes before the first one, the first one may get the <code>denied:  requested access to the resource is denied</code> message even tough you logged in properly.</p>
  <p>On our servers i solved this by using a custom <a href="https://gist.github.com/ap-wtioit/5e8379a1acc74affffe15f754ef1f6e1" rel="nofollow noreferrer">credentials script</a> that does not store the credentials in a shared file but uses the credentials present in the <a href="https://docs.gitlab.com/ee/ci/variables/predefined_variables.html" rel="nofollow noreferrer">gitlab ci job environment</a></p>
  
Answers: CC BY-SA 4.0
Answers: 2021-01-22T08:34:10.120Z
Answers: 2021-01-22T08:34:10.120Z
Answers: bigbear3001
Body: <p>I have built a custom base image from alpine and use it as the base for ruby services that we develop.</p>
  
  <pre><code>FROM ruby:2.4.2-alpine
  ...
  </code></pre>
  
  <p>I use Gitlab and Gitlab's docker registry along with it. Each project has its own docker image storage. </p>
  
  <p>I created a separate project for the <strong>alpine-ruby-service</strong> dockerfile. Then build and pushed the image to Gitlab.</p>
  
  <p>In the ruby service project docker images, I reference it as follows</p>
  
  <pre><code>FROM gitlab.mycompany.dk/alpine-ruby-service-base
  ...
  </code></pre>
  
  <p>I have a CI/CD pipeline (.gitlab-ci.yaml) which builds these ruby service images when there is a commit to one of the branches. </p>
  
  <p>The problem is that when the CI/CD pipeline is run it fails with the following message </p>
  
  <pre><code> $ docker build --pull -t $CONTAINER_TEST_IMAGE .
     Sending build context to Docker daemon  709.6kB
  
   Step 1/13 : FROM gitlab.mycompany.dk:xxxx/alpine-ruby-service-base
   pull access denied for gitlab.mycompany.dk:xxxx/alpine-ruby-service-base,
   repository does not exist or may require 'docker login': denied: 
   requested access to the resource is denied
  </code></pre>
  
  <p>I have an instruction to login to the Gitlab docker registry before the build command above using </p>
  
  <pre><code> docker login --username=gitlab-ci-token --password=$CI_JOB_TOKEN gitlab.mycompany.dk:xxxx
  </code></pre>
  
  <p>the login succeeds but the following docker build instruction fails!!! can someone point me what is going wrong?</p>
  
Tags: <docker><gitlab><cicd><docker-registry>
Title: Gitlab CI/CD fails to build docker image
UserDisplayName: CodeWeed
ThreadText: # Gitlab CI/CD fails to build docker image
  
  (Asked by: username_0 on 2019-08-06)
  
  I have built a custom base image from alpine and use it as the base for ruby services that we develop.
  
  ```
  FROM ruby:2.4.2-alpine
  ...
  
  ```
  
  I use Gitlab and Gitlab's docker registry along with it. Each project has its own docker image storage.
  
  I created a separate project for the **alpine-ruby-service** dockerfile. Then build and pushed the image to Gitlab.
  
  In the ruby service project docker images, I reference it as follows
  
  ```
  FROM gitlab.mycompany.dk/alpine-ruby-service-base
  ...
  
  ```
  
  I have a CI/CD pipeline (.gitlab-ci.yaml) which builds these ruby service images when there is a commit to one of the branches.
  
  The problem is that when the CI/CD pipeline is run it fails with the following message
  
  ```
   $ docker build --pull -t $CONTAINER_TEST_IMAGE .
     Sending build context to Docker daemon  709.6kB
  
   Step 1/13 : FROM gitlab.mycompany.dk:xxxx/alpine-ruby-service-base
   pull access denied for gitlab.mycompany.dk:xxxx/alpine-ruby-service-base,
   repository does not exist or may require 'docker login': denied: 
   requested access to the resource is denied
  
  ```
  
  I have an instruction to login to the Gitlab docker registry before the build command above using
  
  ```
   docker login --username=gitlab-ci-token --password=$CI_JOB_TOKEN gitlab.mycompany.dk:xxxx
  
  ```
  
  the login succeeds but the following docker build instruction fails!!! can someone point me what is going wrong?
  
  **Tags:** docker, gitlab, cicd, docker-registry
  
  
  ---
  
  ## 2 answers
  
  ### Answer by username_1 on 2019-08-07. Score: 2
  
  It looks like that the `docker login` and the `docker build` were done by different users. If a `docker login` is performed, then a `~/.docker` directory will be created in the namespace of user X, if the build is done by user Y then the latter user does not have a .docker folder and is not authorized to pull the image. One could verify this by `echo $USER` in the pipeline, in this case gitlab-ci.yaml to check this.
  
  > **Comments:**
  > **username_0**: I tried to put the *echo $USER* in the .gitlab-ci.yml but it doesn't print anything. I tried to change the base image from *FROM gitlab.mycompany.dk/alpine-ruby-service-base* to docker hub public repository and it works. I checked the ~/.docker directory and all the registry login details are there.  
  
  ---
  
  ### Answer by username_2 on 2021-01-22. Score: 0
  
  This could also be happening if you perform a `docker login` before the `docker pull` in a gitlab runnner as instructed if:
  
  Your shell runner is configured to run multiple builds and all the builds share the same home directory /home/gitlab-runner-username. Per default `docker login` saves the credentials in ~/.docker/config.json. When there is multiple build jobs running the second build job may overwrite the credentials of the first one. When the second one is triggered by a different user or finishes before the first one, the first one may get the `denied: requested access to the resource is denied` message even tough you logged in properly.
  
  On our servers i solved this by using a custom [credentials script](https://gist.github.com/ap-wtioit/5e8379a1acc74affffe15f754ef1f6e1) that does not store the credentials in a shared file but uses the credentials present in the [gitlab ci job environment](https://docs.gitlab.com/ee/ci/variables/predefined_variables.html)
  
  
  ---
  
  