DK_BUILDKIT_AUTH cicd auth_error ai_generated true

ERROR: failed to solve: failed to fetch oauth token: unexpected status from GET request: 403 Forbidden

ID: cicd/docker-buildkit-ssh-auth-failed

Also available as: JSON · Markdown · 中文
85%Fix Rate
87%Confidence
1Evidence
2024-01-20First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
Docker 24.0.x active — — —
Docker 25.0.x active — — —
BuildKit 0.12.x active — — —

Root Cause

Docker BuildKit fails to authenticate with a private container registry due to missing or expired credentials, or because the registry requires authentication but the build context does not have the necessary Docker config.

generic

中文

Docker BuildKit 因缺少或过期的凭据无法通过私有容器注册表进行身份验证，或者注册表需要身份验证但构建上下文没有必要的 Docker 配置。

Official Documentation

https://docs.docker.com/build/buildkit/

Workarounds

  1. 90% success Pass Docker credentials explicitly to BuildKit using `--secret` during build: `DOCKER_BUILDKIT=1 docker build --secret id=dockerconfig,src=$HOME/.docker/config.json -t image:tag .` and reference it in Dockerfile with `RUN --mount=type=secret,id=dockerconfig,dst=/root/.docker/config.json`. 
    Pass Docker credentials explicitly to BuildKit using `--secret` during build: `DOCKER_BUILDKIT=1 docker build --secret id=dockerconfig,src=$HOME/.docker/config.json -t image:tag .` and reference it in Dockerfile with `RUN --mount=type=secret,id=dockerconfig,dst=/root/.docker/config.json`.
  2. 80% success Use `docker buildx build` with `--push` and ensure the registry is logged in via `echo $PASSWORD | docker login -u $USER --password-stdin $REGISTRY` before the build command. 
    Use `docker buildx build` with `--push` and ensure the registry is logged in via `echo $PASSWORD | docker login -u $USER --password-stdin $REGISTRY` before the build command.

中文步骤

  1. Pass Docker credentials explicitly to BuildKit using `--secret` during build: `DOCKER_BUILDKIT=1 docker build --secret id=dockerconfig,src=$HOME/.docker/config.json -t image:tag .` and reference it in Dockerfile with `RUN --mount=type=secret,id=dockerconfig,dst=/root/.docker/config.json`.
  2. Use `docker buildx build` with `--push` and ensure the registry is logged in via `echo $PASSWORD | docker login -u $USER --password-stdin $REGISTRY` before the build command.

Dead Ends

Common approaches that don't work:

  1. 50% fail

    Running `docker logout` and `docker login` again does not help because the build process may not inherit the host's Docker credentials if using a non-default BuildKit configuration.

  2. 40% fail

    Setting `DOCKER_CONFIG` environment variable to a custom path fails if the credentials file is not properly formatted or the registry URL in the config does not match exactly.