insufficient_scope: authorization failed

[AntonioFalcaoJr]

Behaviour

Steps to reproduce this issue

1. Set up QEMU
2. Set up Docker Buildx
3. Login to DockerHub
4. Build and push

Expected behaviour

Publish image to docker hub

Actual behaviour

ERROR: server message: insufficient_scope: authorization failed

Configuration

https://github.com/AntonioFalcao/Dotnet5.GraphQL3.WebApplication
https://hub.docker.com/repository/docker/antoniofalcaojr/dotnet5-graphql3-webapi

name: Push API Image

on:
  push:
    branches: master
  workflow_dispatch:

jobs:
  push_to_registry:
    name: Push Docker image to Docker Hub
    runs-on: ubuntu-latest
    steps:
      -
        name: Set up QEMU
        uses: docker/setup-qemu-action@v1
      -
        name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v1
      -
        name: Login to DockerHub
        uses: docker/login-action@v1 
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
      -
        name: Build and push
        id: docker_build
        uses: docker/build-push-action@v2
        with:
          file: ./src/Dotnet5.GraphQL3.Store.WebAPI/Dockerfile 
          push: true
          tags: antoniofalcaojf/dotnet5-graphql3-webapi:latest
      -
        name: Image digest
        run: echo ${{ steps.docker_build.outputs.digest }}

Command produced

/usr/bin/docker buildx build --tag antoniofalcaojf/dotnet5-graphql3-webapi:latest --iidfile /tmp/docker-build-push-lDmUS3/iidfile --secret id=GIT_AUTH_TOKEN,src=/tmp/docker-build-push-lDmUS3/tmp-3384-twk4xwQeuxwk --file ./src/Dotnet5.GraphQL3.Store.WebAPI/Dockerfile --push https://github.com/AntonioFalcao/Dotnet5.GraphQL3.WebApplication.git#heads/release

Logs

#33 exporting to image
#33 exporting layers
#33 exporting layers 2.4s done
#33 exporting manifest sha256:3c6a2a955932783e726461031bee8657c2ec7f2b2f239c110ba44ae58effef69 done
#33 exporting config sha256:6d39eefff02cee7c50511f16bd824957f3ef082ed60324850954a5aa3b13a5ee done
#33 pushing layers
#33 pushing layers 0.2s done
#33 ERROR: server message: insufficient_scope: authorization failed
------
 > exporting to image:
------
failed to solve: rpc error: code = Unknown desc = server message: insufficient_scope: authorization failed
Error: The process '/usr/bin/docker' failed with exit code 1

[socheatsok78]

I'm having the same issues!

[crazy-max]

@antoniofalcao Looks like the same issue as #162 when Git context is used. Can you use the Path context while waiting for a fix?:

name: Push API Image

on:
  push:
    branches: master
  workflow_dispatch:

jobs:
  push_to_registry:
    name: Push Docker image to Docker Hub
    runs-on: ubuntu-latest
    steps:
      -
        name: Checkout
        uses: actions/checkout@v2
      -
        name: Set up QEMU
        uses: docker/setup-qemu-action@v1
      -
        name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v1
      -
        name: Login to DockerHub
        uses: docker/login-action@v1 
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
      -
        name: Build and push
        id: docker_build
        uses: docker/build-push-action@v2
        with:
          context: .
          file: ./src/Dotnet5.GraphQL3.Store.WebAPI/Dockerfile 
          push: true
          tags: antoniofalcaojf/dotnet5-graphql3-webapi:latest
      -
        name: Image digest
        run: echo ${{ steps.docker_build.outputs.digest }}

[socheatsok78]

Yes adding context: . fix the problem.

[AntonioFalcaoJr]

Thank's @crazy-max, but i already used this approach, and had the same error.

Applying suggestion

name: Push API Image

on:
  push:
    branches: master
  workflow_dispatch:

jobs:
  push_to_registry:
    name: Push Docker image to Docker Hub
    runs-on: ubuntu-latest
    steps:
      -
        name: Checkout
        uses: actions/checkout@v2
      -
        name: Set up QEMU
        uses: docker/setup-qemu-action@v1
      -
        name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v1
      -
        name: Login to DockerHub
        uses: docker/login-action@v1 
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
      -
        name: Build and push
        id: docker_build
        uses: docker/build-push-action@v2
        with:
          context: .
          file: ./src/Dotnet5.GraphQL3.Store.WebAPI/Dockerfile 
          push: true
          tags: antoniofalcaojf/dotnet5-graphql3-webapi:latest
      -
        name: Image digest
        run: echo ${{ steps.docker_build.outputs.digest }}

Command produced

/usr/bin/docker buildx build --tag antoniofalcaojf/dotnet5-graphql3-webapi:latest --iidfile /tmp/docker-build-push-xwP62S/iidfile --file ./src/Dotnet5.GraphQL3.Store.WebAPI/Dockerfile --push .

Logs

#35 exporting to image
#35 exporting layers
#35 exporting layers 2.2s done
#35 exporting manifest sha256:a506612326c0df77c685c8ae913ca22ddb0da48dbb9a74dc8eface5c8ec96b6e
#35 exporting manifest sha256:a506612326c0df77c685c8ae913ca22ddb0da48dbb9a74dc8eface5c8ec96b6e done
#35 exporting config sha256:8508a57b7ee75695eddb38cd79e53398cf12fb5e789a0bf7c9d00a81d5367649 done
#35 pushing layers
#35 pushing layers 0.2s done
#35 ERROR: server message: insufficient_scope: authorization failed
------
 > exporting to image:
------
failed to solve: rpc error: code = Unknown desc = server message: insufficient_scope: authorization failed
Error: The process '/usr/bin/docker' failed with exit code 1

Any suggestion?

[crazy-max]

@antoniofalcao Looks like antoniofalcaojf/dotnet5-graphql3-webapi is missing on Docker Hub. Is it a private repo?

[AntonioFalcaoJr]

@antoniofalcao Looks like antoniofalcaojf/dotnet5-graphql3-webapi is missing on Docker Hub. Is it a private repo?

It's public: https://hub.docker.com/repository/docker/antoniofalcaojr/dotnet5-graphql3-webapi

[crazy-max]

@antoniofalcao So it's a typo in your workflow:

antoniofalcaojf/dotnet5-graphql3-webapi != antoniofalcaojr/dotnet5-graphql3-webapi

[AntonioFalcaoJr]

@antoniofalcao So it's a typo in your workflow:

antoniofalcaojf/dotnet5-graphql3-webapi != antoniofalcaojr/dotnet5-graphql3-webapi

OMG! So sorry about that! It's working now. Thanks!

[chase-moskal]

hello, if anybody else gets stuck on this like i did, here's what i did to solve it

i had to fix my tags setting:

    - name: push image - server
      uses: docker/build-push-action@v2
      with:
        file: ./s/Dockerfile
        context: .
        push: true
        tags: ${{ env.REGISTRY }}/${{ github.repository }}/server:${{ github.sha }}

where

• ${{ env.REGISTRY }} is equivalent with ghcr.io (the github packages registry)
• ${{ github.repository }} is equivalent with chase-moskal/xiome (my github name and private repo's name)
• server is the name i decided for my docker image, since my repo is pushing multiple different images
• ${{ github.sha }} is simply the commit id, which i'm using to identify my staging images (i plan to use git v tags for real production releases)
• thus it computes to something like ghcr.io/chase-moskal/xiome/server:69aa49cd2994f2063f908dd8868f1aa4da2385bddfbc0e069534a7fa5865cb08

this fixed the issue in my case, particularly adding the ghcr.io/ prefix

[pffont]

Hello,

If someone is having the same issue, the solution for me was push to a new repository:

- name: push image - server
      uses: docker/build-push-action@v2
      with:
        push: true
        tags: myuser/new_repository/imagename:tag

[Drallas]

I had this too, make sure myuser is set to you real docker username; that's what caused my Action to fail!

[philipzimmermann]

For me the problem was that I had to login in Docker on the command line:
docker login --username=<username>

[lclarkg18]

I had this too, make sure myuser is set to you real docker username; that's what caused my Action to fail!

Hiding in plain sight!! Thanks a million! It was just changing user for me though, but same line

[moofoo]

Strangely enough, I was getting this error because of a mismatch between the name given to a build stage and the name used in a COPY --from=... instruction. I fortunately stumbled on this answer, which got me looking at the FROM and COPY instructions in my Dockerfile.

I feel like incongruencies between build stage names in FROM and COPY instructions could probably be caught by syntax validation before cascading, somehow, to an auth failure.

Hope this helps somebody, I spent way too much time on this snafu.

[ummae]

Hi, I have a similar problem but none of above solutions works for me. In my case, docker/metadata-action cause the same error following:

Error: buildx failed with: ERROR: failed to solve: failed to push latest: server message: insufficient_scope: authorization failed

Orignal workflow(error):

    runs-on: [self-hosted, cpu]
    steps:
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v2
      - name: Login to Docker Hub
        uses: docker/login-action@v2
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
      - name: Docker meta
        id: meta
        uses: docker/metadata-action@v5
        with:
          tags: type=match,pattern=v(.*),group=1
...

Moving docker/metadata-action before docker/login-action shows silightly different error:

    steps:
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v2
      - name: Docker meta
        id: meta
        uses: docker/metadata-action@v5
        with:
          tags: type=match,pattern=v(.*),group=1
      - name: Login to Docker Hub
        uses: docker/login-action@v2
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
...

buildx failed with: ERROR: failed to solve: failed to push latest: push access denied, repository does not exist or may require authorization: server message: insufficient_scope: authorization failed

It works without a docker/metadata-action step.

docker/build-push-action:

      - name: Build and push
        uses: docker/build-push-action@v3
        with:
          push: true
          context: dockerfiles/mod/
          file: dockerfiles/mod/Dockerfile.base
          target: runtime-image
          cache-from: type=gha
          cache-to: type=gha,mode=max
          tags: <dockerhubusername>/mod:${{ steps.meta.outputs.tags }}
          build-args: |
            USER_ID=1000
            GROUP_ID=1000