Buildah "error pushing ... unauthorized" in CI

By Daniel Zoghalchali·Latchkey

Buildah push authenticates using credentials from a login (buildah login) stored in an auth file, or an explicit --authfile / --creds. Without any of these for the destination host, the registry rejects the push as unauthorized.

What this error means

Buildah fails with "error pushing image ... : unauthorized: authentication required" after building the image successfully.

Error: writing blob: initiating layer upload to /v2/app/blobs/uploads/ in
registry.example.com: unauthorized: authentication required

Common causes

No buildah login before the push

Buildah stores credentials from buildah login in an auth file; without that login (or an equivalent authfile) the push is anonymous.

The auth file is not where Buildah looks

In CI the default auth file path may differ; if REGISTRY_AUTH_FILE is unset and no login ran, Buildah finds no credentials.

How to fix it

Log in before pushing

1. Run buildah login with the registry credentials from CI secrets.
2. Then run buildah push to the destination.
3. Ensure the login and push use the same auth file.

echo "$CI_TOKEN" | buildah login -u "$CI_USER" --password-stdin registry.example.com
buildah push app:latest registry.example.com/app:latest

Or pass credentials inline

Use --creds on the push to avoid a separate login step.

buildah push --creds "$CI_USER:$CI_TOKEN" \
  app:latest docker://registry.example.com/app:latest

How to prevent it

• Run buildah login (or pass --creds) before every push.
• Set REGISTRY_AUTH_FILE consistently across login and push steps.
• Store registry credentials as masked CI secrets.

Frequently asked questions

Related guides

References

• Docker documentation
• Docker build cache
• GitHub Actions documentation