Docker

●MEDIUM●Containerization●BEGINNER

Docker Image Pull Access Denied

docker pull or docker run fails with a pull access denied error against a registry.

Est. Time

15 minutes

Version

v1.0.0

Updated

8/1/2026

Author

AutoDeploy Team

Setup Guide

Download guide

Docker Image Pull Access Denied

Problem

`docker pull` or `docker run` fails with "pull access denied for <image>, repository does not exist or may require authentication".

Symptoms

Error response from daemon: pull access denied
repository does not exist or may require 'docker login'
Works locally after login but fails in CI

Root Cause

Either the image/tag genuinely doesn't exist (typo, wrong tag, private repo the account can't see), or the client isn't authenticated to the registry that hosts it.

Solution

1. Verify the image name and tag are exactly right

docker pull <registry>/<namespace>/<image>:<tag>

2. Log in to the registry

docker login <registry-url>

3. For GitHub Container Registry, use a PAT with read:packages scope

echo $GHCR_TOKEN | docker login ghcr.io -u <username> --password-stdin

4. For AWS ECR, authenticate via the CLI helper

aws ecr get-login-password --region <region> | docker login --username AWS --password-stdin <account-id>.dkr.ecr.<region>.amazonaws.com

5. In CI, confirm the login step runs before the pull step and secrets are populated

- name: Log in to registry
  run: echo "${{ secrets.REGISTRY_TOKEN }}" | docker login ghcr.io -u ${{ github.actor }} --password-stdin

6. Confirm the account actually has read access to a private repository

Prevention

Store registry credentials as CI secrets, never hardcoded
Use least-privilege tokens scoped to package read/write only
Pin image tags (avoid `latest`) so a moved/deleted tag doesn't break builds silently
Add a registry login step explicitly before any pull/build step in CI

References

Last updated on 8/1/2026 · Part of the AutoDeploy DevOps Documentation library