Docker "unauthorized: authentication required" on pull in CI

By Daniel Zoghalchali·Latchkey

The registry demanded credentials the job did not supply. The session is logged out, the token expired, or the image is private and the pull is anonymous.

What this error means

A pull or FROM resolution fails with unauthorized: authentication required. Re-authenticating with a valid token resolves it.

Error response from daemon: unauthorized: authentication required

Common causes

Expired or missing token

A short-lived registry token (ECR, GHCR) expired, or no login ran in this job.

Private image pulled anonymously

The image requires auth but the job never logged in.

How to fix it

Refresh authentication

1. Run a fresh login before the pull, using a current token.

aws ecr get-login-password --region us-east-1 | docker login --username AWS --password-stdin <acct>.dkr.ecr.us-east-1.amazonaws.com

Authenticate in the workflow

1. Use a login action so credentials are present for the pull.

- uses: docker/login-action@v3
  with:
    registry: ghcr.io
    username: ${{ github.actor }}
    password: ${{ secrets.GHCR_TOKEN }}

How to prevent it

• Log in to the registry inside the same job that pulls, and refresh short-lived tokens (ECR/GHCR) right before use. This is a credentials issue, so a retry alone will not fix it.

Frequently asked questions

Related guides

References

• Docker documentation
• Docker build cache
• GitHub Actions documentation