Answers: <p>From the <a href="https://cloud.google.com/container-registry/docs/pushing-and-pulling#before_you_begin" rel="nofollow noreferrer">Before you begin</a> section of the instructions you referenced:</p>
  
  <blockquote>
    <p>Make sure that you:</p>
    
    <ol start="3">
    <li>Have <a href="https://cloud.google.com/container-registry/docs/access-control" rel="nofollow noreferrer">access to the registries</a> which you will be pushing to and pulling from</li>
    </ol>
  </blockquote>
  
  <p>This is specified in more details in <a href="https://cloud.google.com/container-registry/docs/using-with-google-cloud-platform" rel="nofollow noreferrer">Using Container Registry with Google Cloud Platform</a>:</p>
  
  <blockquote>
    <p>To push private Docker images from a Compute Engine instance, your
    instance must have <a href="https://cloud.google.com/storage/docs/authentication#oauth" rel="nofollow noreferrer"><code>read-write</code> or <code>full-control</code> permission</a> to
    the image's bucket.</p>
  </blockquote>
  
  <p>So the GCS bucket corresponding to <code>gcr.io</code> (or whichever GCR domain you want to use) and the desired cloud project must already be created and your GCE instance's service account must have the necessary <a href="https://cloud.google.com/container-registry/docs/access-control#permissions_and_roles" rel="nofollow noreferrer">role/permissions</a> for push operations.</p>
  
  <p>It's true, the instructions you referenced mention in <a href="https://cloud.google.com/container-registry/docs/pushing-and-pulling#push_the_tagged_image_to_product_name_short" rel="nofollow noreferrer">Push the tagged image to Container Registry</a>:</p>
  
  <blockquote>
    <p>When you push an image to a registry with a new hostname, Container
    Registry creates a storage bucket in the specified <a href="https://cloud.google.com/storage/docs/bucket-locations#location-mr" rel="nofollow noreferrer">multi-regional
    location</a>.</p>
  </blockquote>
  
  <p>So I believe you'd have to:</p>
  
  <ul>
  <li>first create create the bucket by executing a push to the desired GCR domain and project, but: 
  
  <ul>
  <li>from your own computer (or some machine which is not a GCE instance, but YMMV)</li>
  <li>using the credentials of an acceptable identity, not the GCE instance service account's ones. I'd try with a real user credentials, I'm not sure if a service account's ones would cut it.</li>
  </ul></li>
  <li>after the bucket is created add to its access control the GCE instance service account's role/permissions for push operations</li>
  <li>then perform pushes from the GCE instance</li>
  </ul>
  
Answers: CC BY-SA 4.0
Answers: 2018-10-20T21:34:08.050Z
Answers: Thank you Dan. Unfortunately, that didn't work (I tried what you suggested). I granted the service-user permissions on the bucket: "Storage Admin" and even granted the IAM service account with: "Compute Storage Admin" and "Storage Admin". I made sure that Billing is also configured properly. Still, the push cannot be done with the service account from the service account instance
Answers: orberkov
Answers: CC BY-SA 4.0
Answers: 2018-10-21T18:28:29.493Z
Answers: The ONLY way I was able to push the containers eventually, was using my personal account on GCE. I can't seem to perform the operation using a service account, not matter what privileges I give it
Answers: orberkov
Answers: CC BY-SA 4.0
Answers: 2018-10-20T16:52:01.047Z
Answers: 2018-10-20T16:52:01.047Z
Answers: Dan Cornilescu
Answers: <p>I faced this same problem when I was trying to automate GCP kubernetes deployment using Jenkins by putting image in GCR and I created one service account giving admin permission in gcp IAM. </p>
  
  <p>I launched one VM giving same IAM service account access.</p>
  
  <p>I installed gcloud sdk using <a href="https://cloud.google.com/sdk/docs/quickstart-debian-ubuntu" rel="nofollow noreferrer">here</a> follows below command.</p>
  
  <p>$gcloud init</p>
  
  <p>$gcloud auth configure-docker</p>
  
  <p>$cd my_api &amp;&amp; docker build --no-cache -t my_api .</p>
  
  <p>$docker tag my_api asia.gcr.io/firebase-mytalk/my_api:latest</p>
  
  <p>$gcloud docker -- push asia.gcr.io/firebase-mytalk/my_api:latest</p>
  
Answers: CC BY-SA 4.0
Answers: 2018-12-21T14:20:37.240Z
Answers: what do you mean "admin permission in gcp" ? to which service in gcp?
Answers: orberkov
Answers: CC BY-SA 4.0
Answers: 2018-12-24T09:28:45.183Z
Answers: project permission as admin
Answers: ShreePool
Answers: CC BY-SA 4.0
Answers: 2018-12-20T06:16:06.413Z
Answers: 2018-12-20T06:16:06.413Z
Answers: ShreePool
Body: <p>I created a new VM instance on my GCE compute engine (I have Owner permissions). On that instance, I installed git, docker, and gcloud - everything is done under <code>sudo su</code>. </p>
  
  <p>I was hoping I can use that VM instance to deploy images to GCR, but whatever I do - <strong>I cannot seem to have sufficient permissions to push</strong> the images from that instance. </p>
  
  <ol>
  <li>I granted "Storage Admin" along with the "Editor" permissions to the VM Instance (autogenerated) IAM service-account.</li>
  <li>When I run <code>docker login eu.gcr.io</code> I receive <code>Login Succeeded</code> with no problems. </li>
  <li>I copied both a p12 key and a .json key to the .ssh folder (I generated them on the IAM console) - but that had no use too.</li>
  <li><p>To tag and push the docker image, I <a href="https://cloud.google.com/container-registry/docs/pushing-and-pulling" rel="nofollow noreferrer">use this:</a>: </p>
  
  <p>docker tag [SOURCE_IMAGE] [HOSTNAME]/[PROJECT-ID]/[IMAGE]</p></li>
  </ol>
  
  <p>and</p>
  
  <pre><code>docker push [HOSTNAME]/[PROJECT-ID]/[IMAGE]
  </code></pre>
  
  <p>Notice: It seems that at this stage (2018) <code>gcloud docker -- push</code> is obsolete (and it didn't work for me as well...) </p>
  
  <p>Notice: The bucket is NOT created yet, so setting permissions on the Storage console is out of the question at this point.</p>
  
  <p>What could be the reason for the Permission Denied problem ?</p>
  
Tags: <docker><google-compute-engine><registry>
Title: Why am I unable to push docker image in gce (gcr.io)?
UserDisplayName: orberkov
ThreadText: # Why am I unable to push docker image in gce (gcr.io)?
  
  (Asked by: username_0 on 2018-10-19)
  
  I created a new VM instance on my GCE compute engine (I have Owner permissions). On that instance, I installed git, docker, and gcloud - everything is done under `sudo su`.
  
  I was hoping I can use that VM instance to deploy images to GCR, but whatever I do - **I cannot seem to have sufficient permissions to push** the images from that instance.
  
  1. I granted "Storage Admin" along with the "Editor" permissions to the VM Instance (autogenerated) IAM service-account.
  2. When I run `docker login eu.gcr.io` I receive `Login Succeeded` with no problems.
  3. I copied both a p12 key and a .json key to the .ssh folder (I generated them on the IAM console) - but that had no use too.
  4. To tag and push the docker image, I [use this:](https://cloud.google.com/container-registry/docs/pushing-and-pulling):
  
     docker tag [SOURCE\_IMAGE] [HOSTNAME]/[PROJECT-ID]/[IMAGE]
  
  and
  
  ```
  docker push [HOSTNAME]/[PROJECT-ID]/[IMAGE]
  
  ```
  
  Notice: It seems that at this stage (2018) `gcloud docker -- push` is obsolete (and it didn't work for me as well...)
  
  Notice: The bucket is NOT created yet, so setting permissions on the Storage console is out of the question at this point.
  
  What could be the reason for the Permission Denied problem ?
  
  **Tags:** docker, google-compute-engine, registry
  
  
  ---
  
  ## 2 answers
  
  ### Answer by username_1 on 2018-10-20. Score: 1
  
  From the [Before you begin](https://cloud.google.com/container-registry/docs/pushing-and-pulling#before_you_begin) section of the instructions you referenced:
  
  > Make sure that you:
  >
  > 3. Have [access to the registries](https://cloud.google.com/container-registry/docs/access-control) which you will be pushing to and pulling from
  
  This is specified in more details in [Using Container Registry with Google Cloud Platform](https://cloud.google.com/container-registry/docs/using-with-google-cloud-platform):
  
  > To push private Docker images from a Compute Engine instance, your
  > instance must have [`read-write` or `full-control` permission](https://cloud.google.com/storage/docs/authentication#oauth) to
  > the image's bucket.
  
  So the GCS bucket corresponding to `gcr.io` (or whichever GCR domain you want to use) and the desired cloud project must already be created and your GCE instance's service account must have the necessary [role/permissions](https://cloud.google.com/container-registry/docs/access-control#permissions_and_roles) for push operations.
  
  It's true, the instructions you referenced mention in [Push the tagged image to Container Registry](https://cloud.google.com/container-registry/docs/pushing-and-pulling#push_the_tagged_image_to_product_name_short):
  
  > When you push an image to a registry with a new hostname, Container
  > Registry creates a storage bucket in the specified [multi-regional
  > location](https://cloud.google.com/storage/docs/bucket-locations#location-mr).
  
  So I believe you'd have to:
  
  * first create create the bucket by executing a push to the desired GCR domain and project, but:
    + from your own computer (or some machine which is not a GCE instance, but YMMV)
    + using the credentials of an acceptable identity, not the GCE instance service account's ones. I'd try with a real user credentials, I'm not sure if a service account's ones would cut it.
  * after the bucket is created add to its access control the GCE instance service account's role/permissions for push operations
  * then perform pushes from the GCE instance
  
  > **Comments:**
  > **username_0**: Thank you Dan. Unfortunately, that didn't work (I tried what you suggested). I granted the service-user permissions on the bucket: "Storage Admin" and even granted the IAM service account with: "Compute Storage Admin" and "Storage Admin". I made sure that Billing is also configured properly. Still, the push cannot be done with the service account from the service account instance  
  > **username_0**: The ONLY way I was able to push the containers eventually, was using my personal account on GCE. I can't seem to perform the operation using a service account, not matter what privileges I give it  
  
  ---
  
  ### Answer by username_2 on 2018-12-20. Score: 1
  
  I faced this same problem when I was trying to automate GCP kubernetes deployment using Jenkins by putting image in GCR and I created one service account giving admin permission in gcp IAM.
  
  I launched one VM giving same IAM service account access.
  
  I installed gcloud sdk using [here](https://cloud.google.com/sdk/docs/quickstart-debian-ubuntu) follows below command.
  
  $gcloud init
  
  $gcloud auth configure-docker
  
  $cd my\_api && docker build --no-cache -t my\_api .
  
  $docker tag my\_api asia.gcr.io/firebase-mytalk/my\_api:latest
  
  $gcloud docker -- push asia.gcr.io/firebase-mytalk/my\_api:latest
  
  > **Comments:**
  > **username_0**: what do you mean "admin permission in gcp" ? to which service in gcp?  
  > **username_2**: project permission as admin  
  
  ---
  
  