Docker "pull access denied" - Fix Image Auth/Name in CI

The registry refused the pull. Either the image is private and the runner never logged in, the repository/name is wrong, or -- less often -- the registry briefly failed the request. Docker reports all of these as "pull access denied".

What this error means

A docker pull or build base-image fetch fails with pull access denied for <image>, repository does not exist or may require 'docker login'. An auth/name problem is deterministic; a one-off that clears on re-run points at the registry.

Error response from daemon: pull access denied for myorg/api, repository does not
exist or may require 'docker login': denied: requested access to the resource is denied

Common causes

Private image without a registry login

The image is in a private repository (GHCR, ECR, Docker Hub private) and the runner never ran docker login, so the pull is unauthenticated and denied.

Wrong image name or registry host

A typo, a missing registry prefix (ghcr.io/...), or a nonexistent tag makes the daemon report the repository as not accessible.

Transient registry failure

A brief registry outage or rate-limit can surface as a denied pull that succeeds on retry.

How to fix it

Log in to the registry before pulling

Authenticate with CI secrets so the runner can read the private repository.

- uses: docker/login-action@v3
  with:
    registry: ghcr.io
    username: ${{ github.actor }}
    password: ${{ secrets.GITHUB_TOKEN }}
- run: docker pull ghcr.io/myorg/api:1.4.2

Verify the full image reference

1. Confirm the registry host, org, repository, and tag are all correct.
2. Check the token/credentials have read (pull) scope on that repository.
3. Pull the exact reference locally with the same credentials to reproduce.

How to prevent it

• Authenticate to private registries with docker/login-action before any pull.
• Use fully qualified image references including the registry host.
• On Latchkey, self-healing managed runners auto-retry transient registry pull failures and rate limits so a momentary blip does not fail the job.

Related guides