# 错误：解析失败：获取 OAuth 令牌失败：GET 请求返回意外状态：403 禁止访问

- **ID:** `cicd/docker-buildkit-ssh-auth-failed`
- **领域:** cicd
- **类别:** auth_error
- **错误码:** `DK_BUILDKIT_AUTH`
- **验证级别:** ai_generated
- **修复率:** 85%

## 根因

Docker BuildKit 因缺少或过期的凭据无法通过私有容器注册表进行身份验证，或者注册表需要身份验证但构建上下文没有必要的 Docker 配置。

## 版本兼容性

| 版本 | 状态 | 引入 | 弃用 |
|------|------|------|------|
| Docker 24.0.x | active | — | — |
| Docker 25.0.x | active | — | — |
| BuildKit 0.12.x | active | — | — |

## 解决方案

1. ```
   Pass Docker credentials explicitly to BuildKit using `--secret` during build: `DOCKER_BUILDKIT=1 docker build --secret id=dockerconfig,src=$HOME/.docker/config.json -t image:tag .` and reference it in Dockerfile with `RUN --mount=type=secret,id=dockerconfig,dst=/root/.docker/config.json`.
   ```
2. ```
   Use `docker buildx build` with `--push` and ensure the registry is logged in via `echo $PASSWORD | docker login -u $USER --password-stdin $REGISTRY` before the build command.
   ```

## 无效尝试

- **** — Running `docker logout` and `docker login` again does not help because the build process may not inherit the host's Docker credentials if using a non-default BuildKit configuration. (50% 失败率)
- **** — Setting `DOCKER_CONFIG` environment variable to a custom path fails if the credentials file is not properly formatted or the registry URL in the config does not match exactly. (40% 失败率)