Docker "pull access denied ... repository does not exist"

Docker could not pull the image because, from its point of view, the repository either does not exist or you are not allowed to see it. The daemon cannot tell those two apart, so it reports both at once.

What this error means

A docker pull or the implicit pull at the start of a docker run/build fails immediately with "pull access denied" and a hint to run docker login. It is deterministic - the same command fails the same way every run until the name or credentials change.

Error response from daemon: pull access denied for myorg/api, repository does
not exist or may require 'docker login': denied: requested access to the
resource is denied

Common causes

The image name or namespace is wrong

A typo, a missing org/namespace, or a tag that was never pushed makes the repository effectively non-existent. Docker Hub also implies the library/ namespace for single-name images, so myimage resolves to docker.io/library/myimage, not your account.

The image is private and the job is unauthenticated

A private repository returns the same "denied" to anonymous clients as a missing one. Without a login the daemon has no way to prove you have access.

Logged into the wrong registry

You authenticated to one registry but the image reference points at another (Docker Hub vs GHCR vs a private host). The credentials never apply to the registry actually being contacted.

How to fix it

Verify the fully-qualified image reference

Spell out the registry, namespace, repository, and tag so there is no implicit resolution.

# wrong: resolves to docker.io/library/api
docker pull api:latest
# right: explicit registry + namespace
docker pull ghcr.io/myorg/api:1.4.2

Authenticate to the correct registry

Log in to the exact host that serves the image before pulling.

- name: Log in to GHCR
  uses: docker/login-action@v3
  with:
    registry: ghcr.io
    username: ${{ github.actor }}
    password: ${{ secrets.GITHUB_TOKEN }}

How to prevent it

• Always reference private images with a fully-qualified name including the registry host.
• Add the registry login as an explicit step before any pull or build that needs it.
• Confirm the tag actually exists in the registry before depending on it.

Frequently asked questions

Related guides