Docker "pull access denied" for a base image in CI

By Kaveh Alemi·Latchkey

The registry refused the pull. The image is private and the job is unauthenticated, or the image reference (name/tag) does not exist for this account.

What this error means

A FROM resolution or docker pull fails with pull access denied for <image>, repository does not exist or may require docker login. Public images pull fine; a specific one does not.

Error response from daemon: pull access denied for myorg/private-base, repository does not exist or may require 'docker login': denied: requested access to the resource is denied

Common causes

Private image, no authentication

The job pulls a private image without logging in to the registry that hosts it.

Wrong image name or tag

A typo or a tag that does not exist returns the same generic denied message.

Credential lacks pull access

The logged-in identity is not authorized for that specific repository.

How to fix it

Authenticate to the registry

1. Log in to the registry that hosts the image before building or pulling.

- uses: docker/login-action@v3
  with:
    registry: ghcr.io
    username: ${{ github.actor }}
    password: ${{ secrets.GHCR_TOKEN }}

Verify the reference and access

1. Confirm the full image name, tag, and registry host.
2. Ensure the credential has pull rights to that repository.

How to prevent it

• Authenticate to every registry a job pulls private images from, and pin exact image references. Auth and naming problems are deterministic, so a retry will not fix them.

Frequently asked questions

Related guides

References

• Docker documentation
• Docker build cache
• GitHub Actions documentation