# ERROR: failed to solve: failed to fetch oauth token: unexpected status from GET request: 403 Forbidden

- **ID:** `cicd/docker-buildkit-ssh-auth-failed`
- **Domain:** cicd
- **Category:** auth_error
- **Error Code:** `DK_BUILDKIT_AUTH`
- **Verification:** ai_generated
- **Fix Rate:** 85%

## Root Cause

Docker BuildKit fails to authenticate with a private container registry due to missing or expired credentials, or because the registry requires authentication but the build context does not have the necessary Docker config.

## Version Compatibility

| Version | Status | Introduced | Deprecated |
|---------|--------|------------|------------|
| Docker 24.0.x | active | — | — |
| Docker 25.0.x | active | — | — |
| BuildKit 0.12.x | active | — | — |

## Workarounds

1. **Pass Docker credentials explicitly to BuildKit using `--secret` during build: `DOCKER_BUILDKIT=1 docker build --secret id=dockerconfig,src=$HOME/.docker/config.json -t image:tag .` and reference it in Dockerfile with `RUN --mount=type=secret,id=dockerconfig,dst=/root/.docker/config.json`.** (90% success)
   ```
   Pass Docker credentials explicitly to BuildKit using `--secret` during build: `DOCKER_BUILDKIT=1 docker build --secret id=dockerconfig,src=$HOME/.docker/config.json -t image:tag .` and reference it in Dockerfile with `RUN --mount=type=secret,id=dockerconfig,dst=/root/.docker/config.json`.
   ```
2. **Use `docker buildx build` with `--push` and ensure the registry is logged in via `echo $PASSWORD | docker login -u $USER --password-stdin $REGISTRY` before the build command.** (80% success)
   ```
   Use `docker buildx build` with `--push` and ensure the registry is logged in via `echo $PASSWORD | docker login -u $USER --password-stdin $REGISTRY` before the build command.
   ```

## Dead Ends

- **** — Running `docker logout` and `docker login` again does not help because the build process may not inherit the host's Docker credentials if using a non-default BuildKit configuration. (50% fail)
- **** — Setting `DOCKER_CONFIG` environment variable to a custom path fails if the credentials file is not properly formatted or the registry URL in the config does not match exactly. (40% fail)