Docker Compose "pull access denied for image" in CI

By Kaveh Alemi·Latchkey

Compose pulls each service's image before starting it. A private image, a misspelled repository, or a missing docker login makes the pull resolve as denied. The job must be authenticated to the registry that hosts the service image.

What this error means

A docker compose up/pull fails with pull access denied for <image>, repository does not exist or may require docker login. A compose service references a private or wrong image.

docker

Error response from daemon: pull access denied for myorg/private-db, repository does not exist or may require 'docker login'

Common causes

A private service image without login

A compose service pointing at a private image needs registry credentials in the job.

A misspelled image or registry path

A wrong repository name resolves to something the identity cannot pull.

How to fix it

Log in before compose pull/up

Authenticate to the registry hosting the service images.
Then run compose.

Terminal

echo "$REGISTRY_TOKEN" | docker login ghcr.io -u myorg --password-stdin
docker compose pull
docker compose up -d

Fix the image reference in the compose file

Correct the registry/namespace/tag for the service image.

docker-compose.yml

services:
  db:
    image: ghcr.io/myorg/private-db:1.4.2

How to prevent it

Authenticate before pulling private compose images.
Pin exact registry/namespace/tag in the compose file.
Keep service-image credentials available in CI.

Frequently asked questions

What causes ""compose pull access denied""?