Docker Compose "pull access denied for image" in CI

Compose tried to pull an image and the registry denied access. From its view the repository either does not exist or needs authentication - a private image, a typo, or a service Compose tried to pull instead of build.

What this error means

A docker compose up/pull fails with pull access denied for <image>, repository does not exist or may require docker login. It is deterministic - the same image fails the same way until the name or credentials are fixed.

docker compose output

Error response from daemon: pull access denied for myorg/internal-api,
repository does not exist or may require 'docker login': denied:
requested access to the resource is denied

Common causes

A private image with no registry login

A service image: points at a private repository, but no docker login ran before compose up, so the pull is unauthorized.

A typo or wrong namespace in image:

A misspelled or unqualified image name resolves to a repository that effectively does not exist for the daemon.

Compose pulling a service it should build

A service with both build: and image: may be pulled (e.g. compose pull, or up without --build) when the image only exists locally after a build, producing a denied pull of a never-pushed name.

How to fix it

Authenticate to the registry before up

Terminal

echo "$REGISTRY_TOKEN" | docker login ghcr.io -u "$GITHUB_ACTOR" --password-stdin
docker compose up -d

Build the service instead of pulling it

For build-only services, build so the image exists locally rather than being pulled.