错误：解析失败：获取 OAuth 令牌失败：GET 请求返回意外状态：403 禁止访问
ERROR: failed to solve: failed to fetch oauth token: unexpected status from GET request: 403 Forbidden
ID: cicd/docker-buildkit-ssh-auth-failed
版本兼容性
| 版本 | 状态 | 引入 | 弃用 | 备注 |
|---|---|---|---|---|
| Docker 24.0.x | active | — | — | — |
| Docker 25.0.x | active | — | — | — |
| BuildKit 0.12.x | active | — | — | — |
根因分析
Docker BuildKit 因缺少或过期的凭据无法通过私有容器注册表进行身份验证，或者注册表需要身份验证但构建上下文没有必要的 Docker 配置。
English
Docker BuildKit fails to authenticate with a private container registry due to missing or expired credentials, or because the registry requires authentication but the build context does not have the necessary Docker config.
官方文档
https://docs.docker.com/build/buildkit/解决方案
-
Pass Docker credentials explicitly to BuildKit using `--secret` during build: `DOCKER_BUILDKIT=1 docker build --secret id=dockerconfig,src=$HOME/.docker/config.json -t image:tag .` and reference it in Dockerfile with `RUN --mount=type=secret,id=dockerconfig,dst=/root/.docker/config.json`.
-
Use `docker buildx build` with `--push` and ensure the registry is logged in via `echo $PASSWORD | docker login -u $USER --password-stdin $REGISTRY` before the build command.
无效尝试
常见但无效的做法:
-
50% 失败
Running `docker logout` and `docker login` again does not help because the build process may not inherit the host's Docker credentials if using a non-default BuildKit configuration.
-
40% 失败
Setting `DOCKER_CONFIG` environment variable to a custom path fails if the credentials file is not properly formatted or the registry URL in the config does not match exactly.