Packer docker-push post-processor "unauthorized" in CI

By Kaveh Alemi·Latchkey

The docker-push post-processor pushes the built image to a registry using the runner Docker credentials. Without a prior registry login, the push is rejected as unauthorized.

What this error means

packer build succeeds building the image, then the docker-push post-processor fails with "unauthorized: authentication required" or "denied: requested access to the resource is denied".

==> docker: Pushing: registry.example.com/app:latest
Build 'docker' errored: Error pushing: unauthorized: authentication required

Common causes

The runner is not logged in to the registry

The docker-push post-processor relies on existing Docker auth. Without docker login, the push has no credentials.

The token lacks push scope

A read-only token authenticates but is denied write access, returning a denied error on push.

How to fix it

Log in to the registry before build

1. Add a registry login step before packer build.
2. Use a token or password from CI secrets with push scope.
3. Run packer build so the post-processor reuses the login.

- uses: docker/login-action@v3
  with:
    registry: registry.example.com
    username: ${{ secrets.REGISTRY_USER }}
    password: ${{ secrets.REGISTRY_TOKEN }}
- run: packer build .

Use a token with push permission

A persistent denied error means the token lacks write scope; issue one that can push to the repository.

How to prevent it

• Log in to the registry as a step before packer build.
• Grant push scope to the registry token.
• Keep registry credentials in CI secrets, not the template.

Frequently asked questions

Related guides

References

• Terraform documentation
• GitHub Actions documentation