[auth/401]: Warning: failed to submit host data via source-aware API: API returned status 401

[wangyan-samuel]

Endpoint/Surface Affected

sirius-engine

Primary Symptom

unknown auth failure

Runbook Checks Completed

• I verified SIRIUS_API_KEY is set and non-empty in all runtime services.
• I confirmed services are using the same active key (sirius-api, sirius-ui, sirius-engine).
• I re-ran installer and restarted services after any key changes.

Diagnostics and Evidence

[root@localhost Sirius]# docker compose down -v --remove-orphans
[+] Running 10/10
✔ Container sirius-engine Removed 1.3s
✔ Container sirius-ui Removed 0.5s
✔ Container sirius-api Removed 0.2s
✔ Container sirius-valkey Removed 0.5s
✔ Container sirius-rabbitmq Removed 6.6s
✔ Container sirius-postgres Removed 0.2s
✔ Volume sirius_rabbitmq_data Removed 0.0s
✔ Volume sirius_valkey_data Removed 0.0s
✔ Volume sirius_postgres_data Removed 0.1s
✔ Network sirius Removed 0.1s
[root@localhost Sirius]#
[root@localhost Sirius]#
[root@localhost Sirius]#
[root@localhost Sirius]#
[root@localhost Sirius]#
[root@localhost Sirius]# docker compose -f docker-compose.installer.yaml run --rm sirius-installer
Initial admin password (leave blank to auto-generate):
NEXTAUTH_URL [http://localhost:3000]:
NEXT_PUBLIC_SIRIUS_API_URL [http://localhost:9001]:
Sirius installer wrote .env
Required startup secrets are configured.

Next step:
docker compose up -d
[root@localhost Sirius]# SIRIUS_IMAGE_PULL_POLICY=never docker compose up --build -d
[+] Building 2.9s (38/38) FINISHED docker:default
=> [sirius-postgres internal] load build definition from Dockerfile 0.0s
=> => transferring dockerfile: 3.76kB 0.0s
=> [sirius-rabbitmq internal] load build definition from Dockerfile 0.0s
=> => transferring dockerfile: 2.47kB 0.0s
=> [sirius-api internal] load metadata for docker.io/library/golang:1.24-alpine 1.3s
=> [sirius-postgres internal] load metadata for docker.io/library/postgres:15-alpine 0.0s
=> [sirius-valkey internal] load build definition from Dockerfile 0.0s
=> => transferring dockerfile: 2.45kB 0.0s
=> [sirius-rabbitmq internal] load metadata for docker.io/library/rabbitmq:3.12-management 0.0s
=> [sirius-valkey internal] load metadata for docker.io/valkey/valkey:7.2-alpine 0.0s
=> [sirius-valkey internal] load .dockerignore 0.0s
=> => transferring context: 2B 0.0s
=> [sirius-rabbitmq internal] load .dockerignore 0.0s
=> => transferring context: 2B 0.0s
=> [sirius-postgres internal] load .dockerignore 0.0s
=> => transferring context: 2B 0.0s
=> [sirius-rabbitmq go-binaries 1/3] FROM docker.io/library/golang:1.24-alpine@sha256:8bee1901f1e530bfb4a7850aa7a479d17ae3a18beb6e0906 0.0s
=> [sirius-valkey stage-1 1/5] FROM docker.io/valkey/valkey:7.2-alpine 0.0s
=> CACHED [sirius-rabbitmq go-binaries 2/3] RUN sed -i 's/dl-cdn.alpinelinux.org/mirrors.aliyun.com/g' /etc/apk/repositories && ap 0.0s
=> CACHED [sirius-rabbitmq go-binaries 3/3] RUN git clone https://github.com/SiriusScan/app-system-monitor.git /tmp/system-monitor && 0.0s
=> CACHED [sirius-valkey stage-1 2/5] COPY --from=go-binaries /usr/local/bin/system-monitor /usr/local/bin/system-monitor 0.0s
=> CACHED [sirius-valkey stage-1 3/5] RUN chmod +x /usr/local/bin/system-monitor 0.0s
=> CACHED [sirius-valkey stage-1 4/5] RUN cat <<'EOF' > /usr/local/bin/start-with-monitor.sh 0.0s
=> CACHED [sirius-valkey stage-1 5/5] RUN chmod +x /usr/local/bin/start-with-monitor.sh 0.0s
=> [sirius-valkey] exporting to image 0.0s
=> => exporting layers 0.0s
=> => writing image sha256:b56d3465e06c2abbd9a41b1abcac5c33e64498e93b0523e236d6fcfca444b8e4 0.0s
=> => naming to docker.io/library/sirius-sirius-valkey 0.0s
=> [sirius-postgres stage-1 1/6] FROM docker.io/library/postgres:15-alpine 0.0s
=> [sirius-rabbitmq stage-1 1/5] FROM docker.io/library/rabbitmq:3.12-management 0.0s
=> CACHED [sirius-postgres stage-1 2/6] COPY --from=go-binaries /usr/local/bin/system-monitor /usr/local/bin/system-monitor 0.0s
=> CACHED [sirius-postgres stage-1 3/6] RUN chmod +x /usr/local/bin/system-monitor 0.0s
=> CACHED [sirius-postgres stage-1 4/6] RUN cat <<'EOF' > /usr/local/bin/start-with-monitor.sh 0.0s
=> CACHED [sirius-postgres stage-1 5/6] RUN sed -i 's/\r$//' /usr/local/bin/start-with-monitor.sh && chmod +x /usr/local/bin/start 0.0s
=> CACHED [sirius-postgres stage-1 6/6] RUN test -x /usr/local/bin/start-with-monitor.sh && /bin/sh -n /usr/local/bin/start-with-monit 0.0s
=> CACHED [sirius-rabbitmq stage-1 2/5] COPY --from=go-binaries /usr/local/bin/system-monitor /usr/local/bin/system-monitor 0.0s
=> CACHED [sirius-rabbitmq stage-1 3/5] RUN chmod +x /usr/local/bin/system-monitor 0.0s
=> CACHED [sirius-rabbitmq stage-1 4/5] RUN cat <<'EOF' > /usr/local/bin/start-with-monitor.sh 0.0s
=> CACHED [sirius-rabbitmq stage-1 5/5] RUN chmod +x /usr/local/bin/start-with-monitor.sh 0.0s
=> [sirius-postgres] exporting to image 0.0s
=> => exporting layers 0.0s
=> => writing image sha256:7fb1027a74e2a46bd0e6c968e870544c8569166de39486b065c50f693e6ab480 0.0s
=> => naming to docker.io/library/sirius-sirius-postgres 0.0s
=> [sirius-rabbitmq] exporting to image 0.0s
=> => exporting layers 0.0s
=> => writing image sha256:64d72582282e632d615c455836758b736f17b3840da7bf404951b68e75632f06 0.0s
=> => naming to docker.io/library/sirius-sirius-rabbitmq 0.0s
=> [sirius-api internal] load build definition from Dockerfile 0.0s
=> => transferring dockerfile: 3.68kB 0.0s
=> [sirius-engine internal] load build definition from Dockerfile 0.0s
=> => transferring dockerfile: 11.16kB 0.0s
=> ERROR [sirius-api internal] load metadata for ghcr.io/siriusscan/sirius-base-go-builder:latest 1.3s
=> CANCELED [sirius-api internal] load metadata for docker.io/library/alpine:latest 1.3s
=> ERROR [sirius-engine internal] load metadata for ghcr.io/siriusscan/sirius-base-engine-tools:latest 1.2s
=> CANCELED [sirius-engine internal] load metadata for docker.io/library/golang:1.24-bullseye 1.2s

[sirius-api internal] load metadata for ghcr.io/siriusscan/sirius-base-go-builder:latest:

---

---

[sirius-engine internal] load metadata for ghcr.io/siriusscan/sirius-base-engine-tools:latest:

---

failed to solve: ghcr.io/siriusscan/sirius-base-go-builder:latest: failed to resolve source metadata for ghcr.io/siriusscan/sirius-base-go-builder:latest: failed to authorize: failed to fetch anonymous token: unexpected status from GET request to https://ghcr.io/token?scope=repository%3Asiriusscan%2Fsirius-base-go-builder%3Apull&service=ghcr.io: 401 Unauthorized

Reproduction Steps

[root@localhost Sirius]# docker compose down -v --remove-orphans
[+] Running 10/10
✔ Container sirius-engine Removed 1.3s
✔ Container sirius-ui Removed 0.5s
✔ Container sirius-api Removed 0.2s
✔ Container sirius-valkey Removed 0.5s
✔ Container sirius-rabbitmq Removed 6.6s
✔ Container sirius-postgres Removed 0.2s
✔ Volume sirius_rabbitmq_data Removed 0.0s
✔ Volume sirius_valkey_data Removed 0.0s
✔ Volume sirius_postgres_data Removed 0.1s
✔ Network sirius Removed 0.1s
[root@localhost Sirius]#
[root@localhost Sirius]#
[root@localhost Sirius]#
[root@localhost Sirius]#
[root@localhost Sirius]#
[root@localhost Sirius]# docker compose -f docker-compose.installer.yaml run --rm sirius-installer
Initial admin password (leave blank to auto-generate):
NEXTAUTH_URL [http://localhost:3000]:
NEXT_PUBLIC_SIRIUS_API_URL [http://localhost:9001]:
Sirius installer wrote .env
Required startup secrets are configured.

Next step:
docker compose up -d
[root@localhost Sirius]# SIRIUS_IMAGE_PULL_POLICY=never docker compose up --build -d
[+] Building 2.9s (38/38) FINISHED docker:default
=> [sirius-postgres internal] load build definition from Dockerfile 0.0s
=> => transferring dockerfile: 3.76kB 0.0s
=> [sirius-rabbitmq internal] load build definition from Dockerfile 0.0s
=> => transferring dockerfile: 2.47kB 0.0s
=> [sirius-api internal] load metadata for docker.io/library/golang:1.24-alpine 1.3s
=> [sirius-postgres internal] load metadata for docker.io/library/postgres:15-alpine 0.0s
=> [sirius-valkey internal] load build definition from Dockerfile 0.0s
=> => transferring dockerfile: 2.45kB 0.0s
=> [sirius-rabbitmq internal] load metadata for docker.io/library/rabbitmq:3.12-management 0.0s
=> [sirius-valkey internal] load metadata for docker.io/valkey/valkey:7.2-alpine 0.0s
=> [sirius-valkey internal] load .dockerignore 0.0s
=> => transferring context: 2B 0.0s
=> [sirius-rabbitmq internal] load .dockerignore 0.0s
=> => transferring context: 2B 0.0s
=> [sirius-postgres internal] load .dockerignore 0.0s
=> => transferring context: 2B 0.0s
=> [sirius-rabbitmq go-binaries 1/3] FROM docker.io/library/golang:1.24-alpine@sha256:8bee1901f1e530bfb4a7850aa7a479d17ae3a18beb6e0906 0.0s
=> [sirius-valkey stage-1 1/5] FROM docker.io/valkey/valkey:7.2-alpine 0.0s
=> CACHED [sirius-rabbitmq go-binaries 2/3] RUN sed -i 's/dl-cdn.alpinelinux.org/mirrors.aliyun.com/g' /etc/apk/repositories && ap 0.0s
=> CACHED [sirius-rabbitmq go-binaries 3/3] RUN git clone https://github.com/SiriusScan/app-system-monitor.git /tmp/system-monitor && 0.0s
=> CACHED [sirius-valkey stage-1 2/5] COPY --from=go-binaries /usr/local/bin/system-monitor /usr/local/bin/system-monitor 0.0s
=> CACHED [sirius-valkey stage-1 3/5] RUN chmod +x /usr/local/bin/system-monitor 0.0s
=> CACHED [sirius-valkey stage-1 4/5] RUN cat <<'EOF' > /usr/local/bin/start-with-monitor.sh 0.0s
=> CACHED [sirius-valkey stage-1 5/5] RUN chmod +x /usr/local/bin/start-with-monitor.sh 0.0s
=> [sirius-valkey] exporting to image 0.0s
=> => exporting layers 0.0s
=> => writing image sha256:b56d3465e06c2abbd9a41b1abcac5c33e64498e93b0523e236d6fcfca444b8e4 0.0s
=> => naming to docker.io/library/sirius-sirius-valkey 0.0s
=> [sirius-postgres stage-1 1/6] FROM docker.io/library/postgres:15-alpine 0.0s
=> [sirius-rabbitmq stage-1 1/5] FROM docker.io/library/rabbitmq:3.12-management 0.0s
=> CACHED [sirius-postgres stage-1 2/6] COPY --from=go-binaries /usr/local/bin/system-monitor /usr/local/bin/system-monitor 0.0s
=> CACHED [sirius-postgres stage-1 3/6] RUN chmod +x /usr/local/bin/system-monitor 0.0s
=> CACHED [sirius-postgres stage-1 4/6] RUN cat <<'EOF' > /usr/local/bin/start-with-monitor.sh 0.0s
=> CACHED [sirius-postgres stage-1 5/6] RUN sed -i 's/\r$//' /usr/local/bin/start-with-monitor.sh && chmod +x /usr/local/bin/start 0.0s
=> CACHED [sirius-postgres stage-1 6/6] RUN test -x /usr/local/bin/start-with-monitor.sh && /bin/sh -n /usr/local/bin/start-with-monit 0.0s
=> CACHED [sirius-rabbitmq stage-1 2/5] COPY --from=go-binaries /usr/local/bin/system-monitor /usr/local/bin/system-monitor 0.0s
=> CACHED [sirius-rabbitmq stage-1 3/5] RUN chmod +x /usr/local/bin/system-monitor 0.0s
=> CACHED [sirius-rabbitmq stage-1 4/5] RUN cat <<'EOF' > /usr/local/bin/start-with-monitor.sh 0.0s
=> CACHED [sirius-rabbitmq stage-1 5/5] RUN chmod +x /usr/local/bin/start-with-monitor.sh 0.0s
=> [sirius-postgres] exporting to image 0.0s
=> => exporting layers 0.0s
=> => writing image sha256:7fb1027a74e2a46bd0e6c968e870544c8569166de39486b065c50f693e6ab480 0.0s
=> => naming to docker.io/library/sirius-sirius-postgres 0.0s
=> [sirius-rabbitmq] exporting to image 0.0s
=> => exporting layers 0.0s
=> => writing image sha256:64d72582282e632d615c455836758b736f17b3840da7bf404951b68e75632f06 0.0s
=> => naming to docker.io/library/sirius-sirius-rabbitmq 0.0s
=> [sirius-api internal] load build definition from Dockerfile 0.0s
=> => transferring dockerfile: 3.68kB 0.0s
=> [sirius-engine internal] load build definition from Dockerfile 0.0s
=> => transferring dockerfile: 11.16kB 0.0s
=> ERROR [sirius-api internal] load metadata for ghcr.io/siriusscan/sirius-base-go-builder:latest 1.3s
=> CANCELED [sirius-api internal] load metadata for docker.io/library/alpine:latest 1.3s
=> ERROR [sirius-engine internal] load metadata for ghcr.io/siriusscan/sirius-base-engine-tools:latest 1.2s
=> CANCELED [sirius-engine internal] load metadata for docker.io/library/golang:1.24-bullseye 1.2s

[sirius-api internal] load metadata for ghcr.io/siriusscan/sirius-base-go-builder:latest:

---

---

[sirius-engine internal] load metadata for ghcr.io/siriusscan/sirius-base-engine-tools:latest:

---

failed to solve: ghcr.io/siriusscan/sirius-base-go-builder:latest: failed to resolve source metadata for ghcr.io/siriusscan/sirius-base-go-builder:latest: failed to authorize: failed to fetch anonymous token: unexpected status from GET request to https://ghcr.io/token?scope=repository%3Asiriusscan%2Fsirius-base-go-builder%3Apull&service=ghcr.io: 401 Unauthorized

[github-actions]

Triage Card

Summary

• Type: type:enhancement
• Areas: area:auth, area:installer-secrets, area:ui, area:api, area:engine, area:rabbitmq, area:postgres, area:valkey
• Severity hint: sev:low
• Status: status:needs-info

Why this classification

• Detected enhancement/request language.
• Matched auth/API-key indicators.
• Matched installer/startup secret indicators.
• Missing diagnostics were detected.

Missing info checklist

• Relevant service logs

Relevant runbooks

• API Key Operations: documentation/dev/operations/README.api-key-operations.md
• Startup/Secrets ADR: documentation/dev/architecture/ADR.startup-secrets-model.md
• Auth Surface Matrix: documentation/dev/architecture/README.auth-surface-matrix.md

Maintainer mobile commands

• /triage needs-info
• /triage repro-ready
• /triage confirmed
• /test health
• /test integration
• /test security auth-surface