Docker "denied: requested access to the resource is denied" on push in CI

By Kaveh Alemi·Latchkey

The registry accepted the connection but rejected the push. The credential has no write access to that repository, the path is wrong, or the job never logged in.

What this error means

A docker push fails with denied: requested access to the resource is denied, often after the layers upload. Pulls may work while pushes do not.

denied: requested access to the resource is denied
error: failed to push ghcr.io/org/app:latest: denied: requested access to the resource is denied

Common causes

Credential lacks write/push scope

A token with read-only or insufficient scope cannot push to the repository.

Wrong repository path

Pushing to a namespace the identity does not own (wrong org/user) is denied.

Not logged in

No docker login to the target registry means anonymous, which cannot push.

How to fix it

Log in with a push-capable token

1. Authenticate with a token that has write/packages scope for the target repo.

- uses: docker/login-action@v3
  with:
    registry: ghcr.io
    username: ${{ github.actor }}
    password: ${{ secrets.GHCR_TOKEN }}

Push to the correct path

1. Tag the image under a namespace the credential owns.
2. For Actions GHCR, grant packages: write in the workflow permissions.

permissions:
  packages: write

How to prevent it

• Use a push-scoped token, declare packages: write where needed, and tag images under a path the credential owns. Push-permission failures are deterministic, not transient.

Frequently asked questions

Related guides

References

• Docker documentation
• Docker build cache
• GitHub Actions documentation