Pulling a Docker image from Packages

[dariagrudzien]

Select Topic Area

Question

Body

Hello all,

We're building and pushing Docker images to Packages as our image registry. I'm writing a GH Actions workflow which would ssh into my server, Docker login to Packages registry and pull the image. All of this is happening within the same repository.

Our GH Actions workflow step:

jobs:
  job1:
    runs-on: ubuntu-latest
    env:
      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    permissions:
      actions: write
      checks: read
      contents: read
      id-token: write
      packages: write
      pull-requests: write

- name: Pull the image
  env:
    GH_USER: ${{ github.repository_owner}}
  run: |
    ssh -T user@server << EOF
    echo $GH_TOKEN | docker login ghcr.io -u $GH_USER --password-stdin
    sudo docker pull ghcr.io/<org>/<repo>/<package>:latest
    EOF

When I try to pull the docker image I get this result:

Error response from daemon: Head "https://ghcr.io/v2/<org>/<repo>/<package>/manifests/latest": unauthorized

We've tried a bunch of ways to authenticate:

• using GH_TOKEN and giving it permissions for packages, contents, actions, pull_requests
• using a GitHub App to generate the GH token
• using a personal access token to manually pull the image from the registry (not from the GH Action), and the user is an admin of the repo which hosts the package, and Packages permissions are inherited from the repo.

We're failing miserably every time. Any hints on what we could be missing?

[aelnosu]

[aelnosu]

go to the package then Package Settings then scroll down and add repository.

[dariagrudzien]

In Manage Actions access in Package settings I have the correct repository added already.

[Pulkit1822]

Troubleshooting Docker Image Pulling from GitHub Packages

If you're facing authentication issues when pulling Docker images from GitHub Packages within a GitHub Actions workflow, here's a guide to help you troubleshoot the problem:

Insights:

1. Authentication Errors: The "unauthorized" error indicates authentication issues when trying to pull Docker images from GitHub Packages.
2. Authentication Methods: Various methods like GitHub tokens, GitHub Apps, and personal access tokens have been tried without success.
3. SSH into Server: The workflow involves SSHing into a server to perform Docker login and image pull operations.

Suggestions for Troubleshooting:

1. Check Permissions: Ensure the GitHub token used for authentication has the necessary permissions for GitHub Packages, with read/write access.
2. Verify Docker Login: Double-check the Docker login command syntax and credentials for authentication with the GitHub Packages registry.
3. Debug SSH Commands: Ensure SSH commands in the GitHub Actions workflow are executed correctly and environment variables are passed as needed.
4. Review Repository Settings: Confirm the user pulling the image has the right permissions in the repository hosting the package and that package settings allow access.
5. Seek GitHub Support: If issues persist, consider reaching out to GitHub Support for further assistance in troubleshooting authentication problems.

By following these steps and verifying your authentication setup, you can address the "unauthorized" error when pulling Docker images from GitHub Packages.

Mark as Correct Answer

If you found this troubleshooting guide helpful, please mark me as the correct answer. Good luck with resolving the authentication issues with pulling Docker images from GitHub Packages!

[Pulkit1822]

@dariagrudzien , I would like to help you out, if create open an issue on it.

[dariagrudzien]

The solution was to run sudo docker login.