Docker "failed to push: insufficient_scope" in CI

By Daniel Zoghalchali·Latchkey

A push needs a token scoped for write access to the target repository. insufficient_scope means the login succeeded but the credential was only granted read (pull) access, or no access to that repo path - so the registry refuses the push at the authorization step.

What this error means

A docker push fails with insufficient_scope: authorization failed. The login worked but the token cannot write to the repo.

failed to push ghcr.io/myorg/api:1.4.2: insufficient_scope: authorization failed

Common causes

A read-only or wrongly scoped token

A PAT or GITHUB_TOKEN without write:packages (or the registry's write scope) cannot push.

Pushing to a repo the identity cannot write

The credential may have no write rights on that namespace or repository path.

How to fix it

Grant the workflow packages write permission

1. Add packages: write to the job permissions when using GITHUB_TOKEN.
2. Log in and push.

permissions:
  contents: read
  packages: write
# then:
# echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u ${{ github.actor }} --password-stdin

Use a token with the write scope

1. For a PAT, include the registry write scope (e.g. write:packages).

echo "$REGISTRY_TOKEN" | docker login ghcr.io -u myorg --password-stdin
docker push ghcr.io/myorg/api:1.4.2

How to prevent it

• Grant write scope to push credentials explicitly.
• Set packages: write for GITHUB_TOKEN-based pushes.
• Verify the identity owns write rights on the namespace.

Frequently asked questions

Related guides

References

• Docker documentation
• Docker build cache
• GitHub Actions documentation