Using private container Error response from daemon: denied

[alexreinking]

I have a private docker image on GitHub packages called ghcr.io/halide/manylinux2014_x86_64-llvm:14.0.6. I have given read access to the halide/Halide repository in the package settings. Yet, I get the following error:

2022-08-20T06:37:47.2544122Z ##[group]Checking docker version
2022-08-20T06:37:47.2560608Z ##[command]/usr/bin/docker version --format '{{.Server.APIVersion}}'
2022-08-20T06:37:47.4263805Z '1.41'
2022-08-20T06:37:47.4275450Z Docker daemon API version: '1.41'
2022-08-20T06:37:47.4275860Z ##[command]/usr/bin/docker version --format '{{.Client.APIVersion}}'
2022-08-20T06:37:47.4612283Z '1.41'
2022-08-20T06:37:47.4638255Z Docker client API version: '1.41'
2022-08-20T06:37:47.4645058Z ##[endgroup]
2022-08-20T06:37:47.4648969Z ##[group]Clean up resources from previous jobs
2022-08-20T06:37:47.4655187Z ##[command]/usr/bin/docker ps --all --quiet --no-trunc --filter "label=94859b"
2022-08-20T06:37:47.4950235Z ##[command]/usr/bin/docker network prune --force --filter "label=94859b"
2022-08-20T06:37:47.5292335Z ##[endgroup]
2022-08-20T06:37:47.5292652Z ##[group]Create local container network
2022-08-20T06:37:47.5302791Z ##[command]/usr/bin/docker network create --label 94859b github_network_11d6de72e37a4119857b3be9cf1f5aec
2022-08-20T06:37:47.6136556Z 8d2626d82531807a74e837270ae250c8cc8eef4098b2236ae456c712b5812971
2022-08-20T06:37:47.6147650Z ##[endgroup]
2022-08-20T06:37:47.6250838Z ##[group]Starting job container
2022-08-20T06:37:47.6271380Z ##[command]/usr/bin/docker --config /home/runner/work/_temp/.docker_1a9606b4-5b3e-46b5-bfc6-cc45e6e76584 login ghcr.io -u alexreinking --password-stdin
2022-08-20T06:37:48.0422488Z ##[command]/usr/bin/docker --config /home/runner/work/_temp/.docker_1a9606b4-5b3e-46b5-bfc6-cc45e6e76584 pull ghcr.io/halide/manylinux2014_x86_64-llvm:14.0.6
2022-08-20T06:37:48.7864412Z Error response from daemon: denied
2022-08-20T06:37:48.7879279Z ##[warning]Docker pull failed with exit code 1, back off 3.085 seconds before retry.
2022-08-20T06:37:51.8774596Z ##[command]/usr/bin/docker --config /home/runner/work/_temp/.docker_1a9606b4-5b3e-46b5-bfc6-cc45e6e76584 pull ghcr.io/halide/manylinux2014_x86_64-llvm:14.0.6
2022-08-20T06:37:52.5930538Z Error response from daemon: denied
2022-08-20T06:37:52.5949690Z ##[warning]Docker pull failed with exit code 1, back off 1.957 seconds before retry.
2022-08-20T06:37:54.5537376Z ##[command]/usr/bin/docker --config /home/runner/work/_temp/.docker_1a9606b4-5b3e-46b5-bfc6-cc45e6e76584 pull ghcr.io/halide/manylinux2014_x86_64-llvm:14.0.6
2022-08-20T06:37:55.2214246Z Error response from daemon: denied
2022-08-20T06:37:55.2346305Z ##[error]Docker pull failed with exit code 1
2022-08-20T06:37:55.2421013Z Remove container network: github_network_11d6de72e37a4119857b3be9cf1f5aec
2022-08-20T06:37:55.2426565Z ##[command]/usr/bin/docker network rm github_network_11d6de72e37a4119857b3be9cf1f5aec
2022-08-20T06:37:55.3494698Z github_network_11d6de72e37a4119857b3be9cf1f5aec

Here's the relevant snippet of my workflow (https://github.com/halide/Halide/pull/6938/files):

    container:
      image: ghcr.io/halide/manylinux2014_x86_64-llvm:14.0.6
      credentials:
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}

I can manually use docker pull from the command line, with a PAT that I created for the purpose.

[64J0]

Having the same issue!

Although I added the repository I'm consuming the image with read permissions in Github UI, it was still failing to download the image in the CI environment. One thing that solve it for me was to set the token permissions and add more powers:

# GITHUB_TOKEN
permissions:
  contents: read
  packages: write # previously was read

[WesleyYue]

Explicitly setting the permissions in the workflow file worked for me. I didn't have to give it extra scope (write scope):

permissions:
  contents: read  #  to fetch code (actions/checkout)
  packages: read  #  to fetch packages (docker)

[TheVineet]

I am trying to pull my priivate docker image stored in Github container registry through docker pull command in my command prompt. I am already logged-in in the Terminal still everytime I try to pull, it says "Error response from daemon: denied". I have tried everything, couldnt find solution to it. Am struck on it since days

[64J0]

Are you authenticated in this environment (GHCR Docker registry)? https://docs.github.com/en/packages/working-with-a-github-packages-registry/working-with-the-container-registry

[TheVineet]

Yes, lemme send you the workflow file
`

name: Build-probably-api

on: [push]

jobs:
  build_docker_img:
    runs-on: ubuntu-latest
    env:
      TAG: probably-api
      PAT: ${{ secrets.GITHUB_TOKEN }}
      USER: thevineet
      REGISTRY: ghcr.io
      VERSION: v1

    steps:
    - name: Checkout
      uses: actions/checkout@v1
    
    - name: Build Docker Image
      run: docker build -t $TAG .
    
    - name: Login to ghcr
      run: |
        echo $PAT | docker login ${{ env.REGISTRY}} -u $USER --password-stdin
        docker tag $TAG ${{ env.REGISTRY }}/$USER/$TAG:${{ env.VERSION }}
        docker push ${{ env.REGISTRY }}/$USER/$TAG:${{ env.VERSION }}

`
I did logged in GCHR registry

[TheVineet]

If I change my package visibility to public, then I am successfuly able to pull it in my terminal through docker pull command, but when I change it so private, I am unable to pull it even tho, I am logged in with github in my terminal

[TMA-Git]

I had this issue and notice it was when using fine grain. I had to use the classic access token

[infraGoga]

did you try in commandline ?

export CR_PAT=(your_PAT)
echo $CR_PAT | docker login ghcr.io -u USER --password-stdin