GoogleContainerTools/skaffold · error

pulling image from repository: %w

Error message

pulling image from repository: %w

What it means

localDaemon.Pull wraps errors from apiClient.ImagePull — the initial registry request to start the pull failed. The function already retried with and without credentials (PrivilegeFunc), so this error means both authenticated and anonymous pull attempts failed. The underlying cause (auth, not-found, network, platform mismatch) is preserved via %w.

Source

Thrown at pkg/skaffold/docker/image.go:550

			Variant:      platform.Variant,
		})
	}

	rc, err := l.apiClient.ImagePull(ctx, ref, client.ImagePullOptions{
		RegistryAuth: registryAuth,
		PrivilegeFunc: func(ctx context.Context) (string, error) {
			// The first pull is unauthorized. There are two situations:
			//   1. if `encodedRegistryAuth()` errored, then `registryAuth == ""` and so we've
			//     tried an anonymous pull which has failed.  So return the original error from
			//     `encodedRegistryAuth()`.
			//   2. If `encodedRegistryAuth()` succeeded (so `err == nil`), then our credential was rejected, so
			//     return "" to retry as an anonymous pull.
			return "", err
		},
		Platforms: platforms,
	})
	if err != nil {
		return fmt.Errorf("pulling image from repository: %w", err)
	}
	defer rc.Close()

	return streamDockerMessages(out, rc, nil)
}

// Load loads an image from a tar file. Returns the imageID for the loaded image.
func (l *localDaemon) Load(ctx context.Context, out io.Writer, input io.Reader, ref string) (string, error) {
	resp, err := l.apiClient.ImageLoad(ctx, input)
	if err != nil {
		return "", fmt.Errorf("loading image into docker daemon: %w", err)
	}
	defer resp.Close()

	if err := streamDockerMessages(out, resp, nil); err != nil {
		return "", fmt.Errorf("reading from image load response: %w", err)
	}

View on GitHub (pinned to a1189de023)

Solutions

1. Authenticate for the registry: `docker login <registry>` or the cloud equivalent (`gcloud auth configure-docker`, `aws ecr get-login`).
2. Verify the image/tag exists: `docker manifest inspect <ref>`.
3. Check that the requested platform (os/arch) has a matching manifest, or drop the platform constraint.
4. Test connectivity to the registry (`curl https://<registry>/v2/`) and check proxy/VPN settings.

Example fix

// before: unauthenticated pull of private image fails
skaffold dev
// after
gcloud auth configure-docker && skaffold dev

// pre-flight: does the reference exist and is auth set up?
if _, err := client.DistributionInspect(ctx, ref, opts); err != nil {
    return fmt.Errorf("image %q not reachable; run `docker login <registry>`: %w", ref, err)
}

When it happens

Trigger: Calling Pull(ctx, out, ref, platform) when the registry refuses the pull: image does not exist, no credentials and image is private, both sets of credentials rejected, or the requested platform has no matching manifest.

Common situations: Pulling a private image whose credentials were never configured (`gcloud auth configure-docker`, `docker login`), typo in image tag, image only built for linux/amd64 while pulling for linux/arm64, corporate proxy blocking the registry.

Related errors

• getting auth config: %w
• %s %q: %w
• docker config: %w
• parsing image name for registry: %w
• getting auth config for %q: %w

AI-assisted analysis of GoogleContainerTools/skaffold@a1189de023 (2026-09-05). Data as JSON: /api/errors/d1d134327ac5c372. Report an issue: GitHub.