Gradle Jib / bootBuildImage Failure - Fix Image Build in CI

By Kaveh Alemi·Latchkey

A Gradle container-image build with the Jib plugin (jib) or Spring Boot’s bootBuildImage failed. As with Maven, the usual causes are registry authentication (401/403), an unreachable base image, or - for bootBuildImage - no Docker daemon for the buildpacks builder. Pure base-image pulls can blip transiently.

What this error means

The jib/bootBuildImage task fails with Build image failed, Unauthorized (401)/403 Forbidden, Connection to the Docker daemon ... failed, or a base-image pull timeout. Compile and test passed; only the image step failed.

gradle output

> Task :app:jib FAILED
com.google.cloud.tools.jib.plugins.common.BuildStepsExecutionException:
Build image failed, perhaps you should make sure your credentials for
'registry.example.com/app' are set up correctly. Unauthorized (401)

Common causes

Registry authentication missing or wrong

Jib pushes (and may pull a private base) using credential helpers or to/from auth. Absent or stale CI credentials produce 401/403.

No Docker daemon for bootBuildImage, or a base-image pull failure

bootBuildImage runs buildpacks against a Docker daemon - none available means a daemon-connection failure. An unreachable base-image registry can also time out the pull (often transient).

How to fix it

Supply registry credentials in CI

Provide auth for source and target registries via task config or -P/environment.

build.gradle.kts

jib {
    from { image = "eclipse-temurin:21-jre" }
    to {
        image = "registry.example.com/app:latest"
        auth {
            username = System.getenv("REG_USER")
            password = System.getenv("REG_TOKEN")
        }
    }
}

Ensure a Docker daemon for bootBuildImage (or use jib registry push)

bootBuildImage needs Docker; Jib’s jib task pushes to a registry without a daemon.

Terminal

docker info >/dev/null   # bootBuildImage needs this to succeed
./gradlew bootBuildImage
# OR daemonless registry push:
./gradlew jib

How to prevent it

Inject registry credentials from CI secrets for both from and to.
Prefer the daemonless jib task in CI over Docker-dependent bootBuildImage.
Pin and mirror base images to reduce dependence on a public registry.

Frequently asked questions

What causes ""Build image failed" (Jib Gradle)"?

Jib pushes (and may pull a private base) using credential helpers or to/from auth. Absent or stale CI credentials produce 401/403.

How do I fix "Build image failed" (Jib Gradle)?

Provide auth for source and target registries via task config or -P/environment.

Can Latchkey fix this automatically?

Yes. Latchkey runs your GitHub Actions on managed runners that detect this failure, apply the fix, and retry the job automatically - self-healing is on by default.