What causes "Failed to authenticate with registry ${registryUrl}/${imageName}" in GoogleContainerTools/jib?

Re-check registry username/password (docker login to verify)

GoogleContainerTools/jib · error · RegistryAuthenticationFailedException

Failed to authenticate with registry ${registryUrl}/${imageN

Error message

Failed to authenticate with registry ${registryUrl}/${imageName}

What it means

RegistryAuthenticator.authenticate wraps any non-401-cleared ResponseException from the auth server in RegistryAuthenticationFailedException with the message 'Failed to authenticate with registry <registry>/<image>'. This is the generic authentication failure path for HTTP errors from the token endpoint.

Source

Thrown at jib-core/src/main/java/com/google/cloud/tools/jib/registry/RegistryAuthenticator.java:305

        if (responseJson.getToken() == null) {
          throw new RegistryAuthenticationFailedException(
              registryUrl,
              imageName,
              "Did not get token in authentication response from "
                  + getAuthenticationUrl(credential, repositoryScopes)
                  + "; parameters: "
                  + getAuthRequestParameters(credential, repositoryScopes));
        }
        return Authorization.fromBearerToken(responseJson.getToken());
      }

    } catch (ResponseException ex) {
      if (ex.getStatusCode() == HttpStatusCodes.STATUS_CODE_UNAUTHORIZED
          && ex.requestAuthorizationCleared()) {
        throw new RegistryCredentialsNotSentException(registryUrl, imageName);
      }
      throw new RegistryAuthenticationFailedException(registryUrl, imageName, ex);

    } catch (IOException ex) {
      throw new RegistryAuthenticationFailedException(registryUrl, imageName, ex);
    }
  }
}

View on GitHub (pinned to fb949e2676)

Solutions

Re-check registry username/password (docker login to verify)
Retry later or check the auth service status if the cause is a 5xx
Ensure the auth realm host is reachable from the build environment (proxy/firewall settings)
Inspect the cause (RegistryAuthenticationFailedException.getCause) for the actual HTTP status

Example fix

// before: stale password in CI secret
PASSWORD=$OLD_SECRET
// after: refresh secret
PASSWORD=$(vault kv get -field=password secret/registry)

Defensive patterns

Strategy: try-catch

Try / catch

try { authenticator.authenticate(scope); } catch (RegistryAuthenticationFailedException e) { if (e.getCause() instanceof ResponseException re && re.getStatusCode() >= 500) { retryLater(); } else { failWithCredentialHint(e); } }

Prevention

Rotate registry secrets regularly and sync them into CI
Check auth service health before large builds
Log the underlying cause to distinguish 4xx vs 5xx

When it happens

Trigger: The token/auth endpoint returns an HTTP error (e.g., 401 without cleared-authorization semantics, 403, 500) during authenticate(); the ResponseException is not the credentials-not-sent case.

Common situations: Wrong password/expired token for the registry; auth server outage or 5xx; rate-limited auth endpoint; firewall/proxy blocking the auth realm host.

Understand the failure class

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of GoogleContainerTools/jib@fb949e2676 (2026-09-06). Data as JSON: /api/errors/47652cade79b475a. Report an issue: GitHub.