Failed to push to harbor registry: 401 Unauthorized
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 35/100
- Issue type
- Bug
- Clarity
- Mostly clear
- Activity status
- Stale
- Tech stack
- docker, dockerfile, go, kubernetes
- Domain
- build-system, devops, infrastructure
Research direction
Reproduce the build with the Kubernetes deployment example, buildctl v0.11.2, the mounted config.json, and the two Harbor project credentials. Inspect how credentials are selected across the Dockerfile pull and final image push; done means project-a pulls and project-b pushes consistently without intermittent 401 responses.
Written by the indexing model from the issue text.
Description
I'm trying to build and push images to harbor registry.
- using buildkitd as a deployment in k8s cluster: https://github.com/moby/buildkit/blob/master/examples/kubernetes/deployment%2Bservice.rootless.yaml
- Buildctl v0.11.2 on client side.
Problem
I have 2 credentials that are mounted on the client side pod in the same config.json which points to 2 different projects in a harbor registry e.g.
- harbor.xxxxx/project-a - common project used to store base images used by other images
- harbor.xxxxx/project-b - used to push to image to specific project
My dockerfile looks as such:
FROM harbor.xxxx/project-a/notebook-server/jupyter:latest
ARG PYTHON_VERSION
RUN conda create -n launch-nb python=$PYTHON_VERSION ipykernel ipython_genutils
I need to be able to pull the harbor.xxxx/project-a/notebook-server/jupyter:latest image in the first layer of the Dockerfile and once built i need to push the image to harbor.xxxx/project-b/nb/jupyter-custom:abcd.
Every few runs i hit the following error (sometimes the push is successful):
#12 exporting to image
#12 pushing layers 0.1s done
#12 ERROR: failed to push harbor.xxxx/project-b/nb/jupyter-custom:abcd: unexpected status: 401 Unauthorized
------
> exporting to image:
------
error: failed to solve: failed to push harbor.xxxx/project-b/nb/jupyter-custom:abcd: unexpected status: 401 Unauthorized
Expected result
Buildctl should check all credentials before returning the 401 Unauthorized error.
- Dominant language
- Go
- Stars
- 10.3k
- Forks
- 1.5k
- Avg merge
- 1d 23h
- Merged PRs (30d)
- 48
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from moby/buildkit
-
status/triage
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
-
area/dockerfile
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
-
Difficulty 4/5 3-5 days Newbie friendliness 45/100
-
Difficulty 4/5 3-5 days Newbie friendliness 48/100
Similar issues
-
optimization optimization:agents-md-curator
Difficulty 2/5 1-3 hours Newbie friendliness 86/100
githubnext/gh-aw-cao#13143 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
blinklabs-io/bursa#904 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
yanet-platform/ipfw-go#129 ·
-
bug confmap/provider/googlesecretmanagerprovider needs triage
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
open-telemetry/opentelemetry-collector-contrib#51273 · 2 comments ·
-
bug: AI Gateway client filter lists "Unknown" twice when NULL and literal Unknown clients coexist Openbug
Difficulty 2/5 1-3 hours Newbie friendliness 90/100