Unauthorized errors connecting to Docker Hub with credentials

[jamietanna]

How are you running Renovate?

Self-hosted

If you're self-hosting Renovate, tell us what version of Renovate you run.

34.101.0

If you're self-hosting Renovate, select which platform you are using.

github.com

If you're self-hosting Renovate, tell us what version of the platform you run.

No response

Was this something which used to work for you, and then stopped?

It used to work, and then stopped

Wanted end result.

Authentication to Docker Hub works correctly, but right now we're receiving HTTP 401s back from Docker Hub.

It appears to be intermittent, and we're sometimes receiving successful responses + updating images, but sometimes receiving errors.

This has been happening since 20th February, of which there were no config or image changes since 31st January.

We're using Renovate On-Prem v3.0.2, and this occurs when initiated through a webhook or a scheduled run.

What you tried so far.

  hostRules: [
    {
      hostType: 'docker',
      matchHost: 'docker.io',
      username: process.env.DOCKER_HUB_USERNAME,
      password: process.env.DOCKER_HUB_PASSWORD, // where this is set to the account's password
    },

  hostRules: [
    {
      hostType: 'docker',
      matchHost: 'docker.io',
      username: process.env.DOCKER_HUB_USERNAME,
      password: process.env.DOCKER_HUB_PASSWORD, // where this is set to a read-only access token
    },

Relevant debug logs

Logs

Note that this is an ERROR level, not DEBUG - I can provide debug logs too

{
    "name": "renovate",
    "hostname": "449c66a34cfe",
    "pid": 17,
    "level": 40,
    "logContext": "cUZOar4il",
    "repository": "...",
    "registryHost": "https://index.docker.io",
    "dockerRepository": "library/ubuntu-2004",
    "err": {
        "name": "HTTPError",
        "code": "ERR_NON_2XX_3XX_RESPONSE",
        "timings": {
            "start": 1677084748524,
            "socket": 1677084748524,
            "lookup": 1677084748524,
            "connect": 1677084748593,
            "secureConnect": 1677084748664,
            "upload": 1677084748665,
            "response": 1677084748737,
            "end": 1677084748737,
            "phases": {
                "wait": 0,
                "dns": 0,
                "tcp": 69,
                "tls": 71,
                "request": 1,
                "firstByte": 72,
                "download": 0,
                "total": 213
            }
        },
        "message": "Response code 401 (Unauthorized)",
        "stack": "HTTPError: Response code 401 (Unauthorized)\n    at Request.<anonymous> (/usr/src/app/node_modules/got/dist/source/as-promise/index.js:118:42)\n    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)",
        "options": {
            "headers": {
                "user-agent": "WhiteSource Renovate",
                "accept": "application/json",
                "authorization": "***********",
                "accept-encoding": "gzip, deflate, br"
            },
            "url": "https://index.docker.io/v2/library/ubuntu-2004/tags/list?n=10000",
            "hostType": "docker",
            "username": "",
            "password": "",
            "method": "GET",
            "http2": false
        },
        "response": {
            "statusCode": 401,
            "statusMessage": "Unauthorized",
            "body": {
                "errors": [
                    {
                        "code": "UNAUTHORIZED",
                        "message": "authentication required",
                        "detail": [
                            {
                                "Type": "repository",
                                "Class": "",
                                "Name": "library/ubuntu-2004",
                                "Action": "pull"
                            }
                        ]
                    }
                ]
            },
            "headers": {
                "content-type": "application/json",
                "docker-distribution-api-version": "registry/2.0",
                "www-authenticate": "Bearer realm=\"https://auth.docker.io/token\",service=\"registry.docker.io\",scope=\"repository:library/ubuntu-2004:pull\",error=\"insufficient_scope\"",
                "date": "Wed, 22 Feb 2023 16:52:28 GMT",
                "content-length": "162",
                "strict-transport-security": "max-age=31536000",
                "connection": "close"
            },
            "httpVersion": "1.1",
            "retryCount": 0
        }
    },
    "msg": "docker registry failure: unauthorized",
    "time": "2023-02-22T16:52:28.738Z",
    "v": 0
}

[viceice]

library/ubuntu-2004 looks wrong, i don't think that image exists

[jamietanna]

Huh, very good spot! I'd assumed that this was maybe a different representation of library/ubuntu:20.04 maybe by Renovate, but it looks like we have some repos that do set this, and are CircleCI images:

    machine:
      image: ubuntu-2004:202107-02

(via)

I believe these are not picked up by Renovate's inbuilt CircleCI image parsing, but this custom packageRule that we've got in our config:

    {
      "fileMatch": [
        "^.circleci/config.yml$"
      ],
      "matchStrings": [
        "image:\\s+(?<depName>[^:]+):(?<currentValue>[^\\s]+)"
      ],
      "datasourceTemplate": "docker"
    }

In which case, we should be good to ignore these errors. Thanks for the eagle eyes spot!

[viceice]

create a package rule to ignore that image and the error will be gone