{
  "id": "cicd/docker-buildkit-ssh-auth-failed",
  "signature": "ERROR: failed to solve: failed to fetch oauth token: unexpected status from GET request: 403 Forbidden",
  "signature_zh": "错误：解析失败：获取 OAuth 令牌失败：GET 请求返回意外状态：403 禁止访问",
  "regex": "failed to fetch oauth token: unexpected status from GET request: 403 Forbidden",
  "domain": "cicd",
  "category": "auth_error",
  "subcategory": null,
  "root_cause": "Docker BuildKit fails to authenticate with a private container registry due to missing or expired credentials, or because the registry requires authentication but the build context does not have the necessary Docker config.",
  "root_cause_type": "generic",
  "root_cause_zh": "Docker BuildKit 因缺少或过期的凭据无法通过私有容器注册表进行身份验证，或者注册表需要身份验证但构建上下文没有必要的 Docker 配置。",
  "versions": [
    {
      "version": "Docker 24.0.x",
      "introduced": null,
      "deprecated": null,
      "removed": null,
      "behavior_change": null,
      "status": "active"
    },
    {
      "version": "Docker 25.0.x",
      "introduced": null,
      "deprecated": null,
      "removed": null,
      "behavior_change": null,
      "status": "active"
    },
    {
      "version": "BuildKit 0.12.x",
      "introduced": null,
      "deprecated": null,
      "removed": null,
      "behavior_change": null,
      "status": "active"
    }
  ],
  "os_specific": {},
  "dead_ends": [
    {
      "action": "",
      "why_fails": "Running `docker logout` and `docker login` again does not help because the build process may not inherit the host's Docker credentials if using a non-default BuildKit configuration.",
      "fail_rate": 0.5,
      "condition": "",
      "sources": []
    },
    {
      "action": "",
      "why_fails": "Setting `DOCKER_CONFIG` environment variable to a custom path fails if the credentials file is not properly formatted or the registry URL in the config does not match exactly.",
      "fail_rate": 0.4,
      "condition": "",
      "sources": []
    }
  ],
  "workarounds": [
    {
      "action": "Pass Docker credentials explicitly to BuildKit using `--secret` during build: `DOCKER_BUILDKIT=1 docker build --secret id=dockerconfig,src=$HOME/.docker/config.json -t image:tag .` and reference it in Dockerfile with `RUN --mount=type=secret,id=dockerconfig,dst=/root/.docker/config.json`.",
      "success_rate": 0.9,
      "how": "Pass Docker credentials explicitly to BuildKit using `--secret` during build: `DOCKER_BUILDKIT=1 docker build --secret id=dockerconfig,src=$HOME/.docker/config.json -t image:tag .` and reference it in Dockerfile with `RUN --mount=type=secret,id=dockerconfig,dst=/root/.docker/config.json`.",
      "condition": "",
      "sources": []
    },
    {
      "action": "Use `docker buildx build` with `--push` and ensure the registry is logged in via `echo $PASSWORD | docker login -u $USER --password-stdin $REGISTRY` before the build command.",
      "success_rate": 0.8,
      "how": "Use `docker buildx build` with `--push` and ensure the registry is logged in via `echo $PASSWORD | docker login -u $USER --password-stdin $REGISTRY` before the build command.",
      "condition": "",
      "sources": []
    }
  ],
  "workarounds_zh": [
    "Pass Docker credentials explicitly to BuildKit using `--secret` during build: `DOCKER_BUILDKIT=1 docker build --secret id=dockerconfig,src=$HOME/.docker/config.json -t image:tag .` and reference it in Dockerfile with `RUN --mount=type=secret,id=dockerconfig,dst=/root/.docker/config.json`.",
    "Use `docker buildx build` with `--push` and ensure the registry is logged in via `echo $PASSWORD | docker login -u $USER --password-stdin $REGISTRY` before the build command."
  ],
  "transition_graph": {
    "leads_to": [],
    "preceded_by": [],
    "frequently_confused_with": []
  },
  "official_doc_url": "https://docs.docker.com/build/buildkit/",
  "official_doc_section": null,
  "error_code": "DK_BUILDKIT_AUTH",
  "verification_tier": "ai_generated",
  "confidence": 0.87,
  "fix_success_rate": 0.85,
  "resolvable": "true",
  "first_seen": "2024-01-20",
  "last_confirmed": "2024-06-01",
  "last_updated": "2024-06-01",
  "evidence_count": 1,
  "tags": [],
  "locale": "en",
  "aliases": []
}