Docker "denied: requested access to the resource is denied" on Push

By Kaveh Alemi·Latchkey

You are authenticated, but the account behind those credentials is not allowed to push to this specific repository. This is an authorization failure, not an authentication one.

What this error means

A docker push reaches the registry, the login succeeded, but the push is rejected with denied: requested access to the resource is denied. The same image pulls fine; only the write is blocked.

The push refers to repository [docker.io/otherorg/api]
denied: requested access to the resource is denied

Diagnose it: separate auth from naming from rate limits

Registry errors look alike and have unrelated causes. Work out which of the three you have before changing credentials, because a malformed image reference produces an error that reads like an authentication failure.

# 1. is the reference even valid? (lowercase, no spaces, valid tag)
docker image inspect "$IMAGE" 2>&1 | head -2

# 2. are you authenticated to the right registry?
cat ~/.docker/config.json | grep -o '"[^"]*\.[^"]*"' | head

# 3. are you rate limited? (Docker Hub anonymous pulls)
curl -s "https://auth.docker.io/token?service=registry.docker.io&scope=repository:ratelimit-preview/test:pull" \
  | grep -o '"token"' >/dev/null && echo "token ok"

Common causes

Pushing to a namespace you do not own

The image is tagged for a repository under an account or org your credentials cannot write to - e.g. tagged otherorg/api while logged in as myorg. Docker Hub also rejects pushes to library/*.

The repository does not exist and auto-create is off

Some registries (and org policies) require the repository to be created first. Pushing to a non-existent repo under a namespace you do control still returns denied if auto-creation is disabled.

Token has read but not write permission

A read-only access token authenticates successfully but cannot push, producing a denial only on write operations.

How to fix it

Tag for a repository you can write to

Make the tag match the authenticated account or org namespace.

# tag under the namespace you own
docker tag api:latest docker.io/myorg/api:1.4.2
docker push docker.io/myorg/api:1.4.2

Create the repository or enable auto-create

1. For ECR, create the repository (or set createRepositoryOnPush).
2. For GHCR/Docker Hub orgs, confirm the package/repo exists and the actor has write access.
3. Use a token/role with push permission, not read-only.

Authenticate in the job, not in the image

- uses: docker/login-action@v3
  with:
    registry: ghcr.io
    username: ${{ github.actor }}
    password: ${{ secrets.GITHUB_TOKEN }}

# GHCR needs this on the job or the push is rejected as unauthorised
permissions:
  contents: read
  packages: write

How to prevent it

• Keep image tags aligned with the namespace your CI credentials own.
• Pre-create registry repositories as part of infrastructure, or enable auto-create.
• Audit token scopes so CI push credentials always include write.

Frequently asked questions

Related guides

References

• Docker documentation
• Docker build cache
• GitHub Actions documentation