GoogleContainerTools/skaffold · error

getting auth config for %q: %w

Error message

getting auth config for %q: %w

What it means

Push needs registry credentials for the referenced image before calling ImagePush. If encodedRegistryAuth (via DefaultAuthHelper) cannot produce auth config for the registry, Push aborts with `getting auth config for <ref>`. This is almost always a registry authentication problem, not a Docker build problem.

Source

Thrown at pkg/skaffold/docker/image.go:429

		if err != nil {
			return "", fmt.Errorf("getting digest: %w", err)
		}
	}

	return imageID, nil
}

// streamDockerMessages streams formatted json output from the docker daemon
func streamDockerMessages(dst io.Writer, src io.Reader, auxCallback func(jsonstream.Message)) error {
	termFd, isTerm := term.IsTerminal(dst)
	return progress.DisplayJSONMessagesStream(src, dst, termFd, isTerm, auxCallback)
}

// Push pushes an image reference to a registry. Returns the image digest.
func (l *localDaemon) Push(ctx context.Context, out io.Writer, ref string) (string, error) {
	registryAuth, err := l.encodedRegistryAuth(ctx, DefaultAuthHelper, ref)
	if err != nil {
		return "", fmt.Errorf("getting auth config for %q: %w", ref, err)
	}

	// Quick check if the image was already pushed (ignore any error).
	if alreadyPushed, digest, err := l.isAlreadyPushed(ctx, ref, registryAuth); alreadyPushed && err == nil {
		return digest, nil
	}

	rc, err := l.apiClient.ImagePush(ctx, ref, client.ImagePushOptions{
		RegistryAuth: registryAuth,
	})
	if err != nil {
		return "", fmt.Errorf("%s %q: %w", sErrors.PushImageErr, ref, err)
	}
	defer rc.Close()

	var digest string
	auxCallback := func(msg jsonstream.Message) {
		if msg.Aux == nil {

View on GitHub (pinned to a1189de023)

Solutions

1. Run `docker login <registry>` (or cloud-specific login like `gcloud auth login` / `aws ecr get-login`) before pushing
2. Verify ~/.docker/config.json contains a valid auths/credHelpers entry for the registry host
3. Ensure the required credential helper binary is installed and on PATH
4. Check the wrapped inner error for the specific auth-helper failure

Example fix

// before
skaffold run   # push to gcr.io without auth
// after
gcloud auth configure-docker
skaffold run

registry := extractRegistryHost(ref)
cfg := loadDockerConfig()
if !hasAuthEntry(cfg, registry) {
	return fmt.Errorf("no credentials for %s; run docker login %s", registry, registry)
}

digest, err := daemon.Push(ctx, out, ref)
if err != nil && strings.Contains(err.Error(), "getting auth config") {
	return fmt.Errorf("run docker login for %s first: %w", ref, err)
}

When it happens

Trigger: localDaemon.Push called with a ref whose registry host has no resolvable credentials — no docker login state for the registry, malformed ~/.docker/config.json, or a credential helper that fails for the registry.

Common situations: Forgetting `docker login` before pushing to a private registry (ECR, GCR, Artifactory); credential helper binaries missing or failing (docker-credential-ecr-login, gcloud auth); pushing to a registry host not covered by any auth entry.

Related errors

• getting auth config: %w
• %s %q: %w
• pulling image from repository: %w
• retrieving image config: %w
• getting image: %w

AI-assisted analysis of GoogleContainerTools/skaffold@a1189de023 (2026-09-05). Data as JSON: /api/errors/2f2d01575c805603. Report an issue: GitHub.