Artifactory Docker "denied" / login failure in CI

A docker push to the Artifactory Docker registry was refused. Either docker login never ran against the registry host, or the token lacks deploy permission on the Docker repo.

What this error means

A docker push to acme.jfrog.io fails with "denied: requested access to the resource is denied" or "unauthorized: authentication required".

denied: requested access to the resource is denied
unauthorized: authentication required

Common causes

No docker login against the Artifactory host

The daemon has no credentials for the registry host, so the push is anonymous and denied.

The token lacks deploy on the Docker repo

Login succeeded but the principal has no Deploy permission on the Docker repository, so the push is refused.

How to fix it

Log in with the access token

1. Run docker login against the Artifactory registry host using the token as the password.
2. Tag the image with the full registry and repo path.
3. Push and confirm the denial clears.

echo "$JF_ACCESS_TOKEN" | docker login acme.jfrog.io -u "$JF_USER" --password-stdin
docker tag app:latest acme.jfrog.io/docker-local/app:latest
docker push acme.jfrog.io/docker-local/app:latest

Grant Deploy on the Docker repository

A denial after a successful login is a permission gap; add Deploy for the CI principal on that Docker repo.

How to prevent it

• docker login before every push, sourcing the token from a secret.
• Grant Deploy on the Docker repo to the CI principal.
• Use the full registry/repo/tag path so pushes target the right repo.

Related guides