Docker Compose "pull access denied for <image>" in CI
Compose could not pull an image one of its services references. pull access denied for <image>, repository does not exist or may require docker login means the service image is private (or misnamed) and the job has no registry authentication.
What this error means
A docker compose up/pull fails with pull access denied for myorg/internal, repository does not exist or may require 'docker login'. A docker login for that registry before the compose command fixes it.
Error response from daemon: pull access denied for myorg/internal-worker,
repository does not exist or may require 'docker login': denied: requested access to the resource is deniedCommon causes
A private service image with no login
A service image: pointing at a private repository needs docker login for that registry; without it Compose cannot pull.
A wrong image name or missing registry prefix
A typo or an image that defaults to Docker Hub when it lives on GHCR/ECR makes Compose look where the repo does not exist.
How to fix it
Log in before the compose command
Authenticate to each registry the services pull from.
echo "${{ secrets.GHCR_TOKEN }}" | docker login ghcr.io -u "${{ github.actor }}" --password-stdin
docker compose pull
docker compose up -dUse fully-qualified image references
Include the registry host in each service image.
services:
worker:
image: ghcr.io/myorg/internal-worker:1.4.2How to prevent it
- Log in to all service registries before
docker compose pull/up. - Use fully-qualified image references in services.
- Store registry tokens as CI secrets, not in the compose file.