Docker "denied: requested access to the resource is denied" in CI

The registry authenticated the client but denied the push: the account has no write access to that repository, or the image is tagged for a namespace the account cannot push to. This is authorization, not authentication.

What this error means

docker push fails with "denied: requested access to the resource is denied", often after a successful docker login.

The push refers to repository [registry.example.com/acme/app]
denied: requested access to the resource is denied

Common causes

The account lacks push permission on the repository

Login succeeded but the user or robot has no write/push role on that project or repository path.

The image is tagged for the wrong namespace

The tag references a namespace the credentials cannot push to (a typo, or a personal namespace instead of the org one).

How to fix it

Grant push and tag for the right namespace

1. Confirm the account has a push/developer role on the target project.
2. Tag the image with the exact registry, namespace, and repository the account can write to.
3. Push again.

docker tag app:latest registry.example.com/acme/app:1.0.0
docker push registry.example.com/acme/app:1.0.0

Verify login identity

Ensure the credentials in CI belong to the account that has push rights, not a read-only viewer.

docker login registry.example.com -u "$REG_USER" --password-stdin <<< "$REG_PASS"

How to prevent it

• Give CI accounts an explicit push role on the target namespace.
• Tag images with the exact registry/namespace/repo before pushing.
• Keep push credentials distinct from read-only pull credentials.

Related guides