build-push-action disregards registry set in docker-login

[3mtee]

Troubleshooting

Before submitting a bug report please read the Troubleshooting doc.

Behaviour

Steps to reproduce this issue

1. Set up job
2. Run workflow.

Expected behaviour

Docker image is built and pushed to to ACR

Actual behaviour

Docker image is built and there's an attempt to push it to registry-1.docker.io

Configuration

It's a private repo.

name: Release

on:
  release:
    types:
      - published
  pull_request:
    branches:
      - master

jobs:
  build:
    environment: development
    runs-on: ubuntu-latest
    steps:

      - name: Check out
        uses: actions/checkout@v3

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v2
        with:
          buildkitd-flags: --debug

      - name: Login to ACR
        uses: docker/login-action@v2
        with:
          registry: 'pwregistry.azurecr.io'
          username: ${{ secrets.ACR_USERNAME }}
          password: ${{ secrets.ACR_PASSWORD }}


      - name: Build and push
        uses: docker/build-push-action@v3
        with:
          context: .
          push: true
          file: 'build/docker/Dockerfile'
          tags: |
            agones-client:latest
            agones-client:0.1.0

Logs

/usr/bin/docker buildx build --file build/docker/Dockerfile --iidfile /tmp/docker-build-push-tITatC/iidfile --tag agones-client:latest --tag agones-client:0.1.0 --metadata-file /tmp/docker-build-push-tITatC/metadata-file --push .
#1 [internal] load build definition from Dockerfile
#1 transferring dockerfile: 1.14kB 0.0s done
#1 DONE 0.1s

#2 [internal] load .dockerignore
#2 transferring context: 2B done
#2 DONE 0.1s

#3 resolve image config for docker.io/docker/dockerfile:1
#3 ...

#4 [auth] docker/dockerfile:pull token for registry-1.docker.io
#4 DONE 0.0s

#3 resolve image config for docker.io/docker/dockerfile:1
#3 DONE 1.6s

#5 docker-image://docker.io/docker/dockerfile:1@sha256:443aab4ca21183e069e7d8b2dc68006594f40bddf1b15bbd83f5137bd93e80e2
#5 resolve docker.io/docker/dockerfile:1@sha256:443aab4ca21183e069e7d8b2dc68006594f40bddf1b15bbd83f5137bd93e80e2 0.0s done
#5 sha256:09768fef35f2ee387f57e401ae685727d12d1c70c6fd8545a422850167bf1940 0B / 9.94MB 0.2s
#5 sha256:09768fef35f2ee387f57e401ae685727d12d1c70c6fd8545a422850167bf1940 3.15MB / 9.94MB 0.3s
#5 sha256:09768fef35f2ee387f57e401ae685727d12d1c70c6fd8545a422850167bf1940 9.94MB / 9.94MB 0.4s done
#5 extracting sha256:09768fef35f2ee387f57e401ae685727d12d1c70c6fd8545a422850167bf1940
#5 extracting sha256:09768fef35f2ee387f57e401ae685727d12d1c70c6fd8545a422850167bf1940 0.2s done
#5 DONE 0.7s

#6 [auth] library/alpine:pull token for registry-1.docker.io
#6 DONE 0.0s

#7 [auth] library/golang:pull token for registry-1.docker.io
#7 DONE 0.0s

#8 [internal] load metadata for docker.io/library/golang:1.18
#8 ...

#9 [internal] load metadata for docker.io/library/alpine:latest
#9 DONE 0.6s

#8 [internal] load metadata for docker.io/library/golang:1.18
#8 DONE 0.6s

#10 [stage-1 1/5] FROM docker.io/library/alpine:latest@sha256:686d8c9dfa6f3ccfc8230bc3178d23f84eeaf7e457f36f271ab1acc53015037c
#10 resolve docker.io/library/alpine:latest@sha256:686d8c9dfa6f3ccfc8230bc3178d23f84eeaf7e457f36f271ab1acc53015037c 0.0s done
#10 ...

#18 DONE 69.0s

#19 [stage-1 3/5] COPY --from=builder /app/appbin /app/agones
#19 DONE 0.4s

#20 [stage-1 4/5] COPY --from=builder /app/configs/app/ /etc/config
#20 DONE 0.0s

#21 [stage-1 5/5] WORKDIR /app
#21 DONE 0.1s

#22 exporting to image
#22 exporting layers
#22 exporting layers 2.2s done
#22 exporting manifest sha256:0745a44903e9bd6374cae8944756295ee99c47e5d5fb0cb7a7c913caedd5defa 0.0s done
#22 exporting config sha256:ed3548f4760629db47b52b698256369f8702000584f9a0d5ceba262cb8b3d71c done
#22 pushing layers
#22 ...

#23 [auth] library/agones-client:pull,push token for registry-1.docker.io
#23 DONE 0.0s

#22 exporting to image
#22 ...

#24 [auth] library/agones-client:pull,push token for registry-1.docker.io
#24 DONE 0.0s

#25 [auth] library/agones-client:pull,push token for registry-1.docker.io
#25 DONE 0.0s

#26 [auth] library/agones-client:pull,push token for registry-1.docker.io
#26 DONE 0.0s

#27 [auth] library/agones-client:pull,push token for registry-1.docker.io
#27 DONE 0.0s

#22 exporting to image
#22 pushing layers 0.7s done
#22 ERROR: server message: insufficient_scope: authorization failed
------
 > exporting to image:
------
error: failed to solve: server message: insufficient_scope: authorization failed
Error: buildx failed with: error: failed to solve: server message: insufficient_scope: authorization failed

[crazy-max]

@3mtee It tries to push to registry-1.docker.io because your tags are wrong:

          tags: |
            agones-client:latest
            agones-client:0.1.0

Should be smth like:

          tags: |
            pwregistry.azurecr.io/agones-client:latest
            pwregistry.azurecr.io/agones-client:0.1.0

[3mtee]

@crazy-max Thank you.
That did the trick. Somehow I missed that it should state the registry as a part of the tag

[Pwuts]

It tries to push to registry-1.docker.io because your tags are wrong:

@crazy-max can you tell me where this is documented? I just spent an hour debugging a workflow, eventually found this issue, but couldn't find anything about this in the documentation.

[crazy-max]

@Pwuts https://docs.docker.com/engine/reference/commandline/tag/#description