apache/beam · error · RuntimeError

Failed to push prebuilt sdk container

Error message

Failed to push prebuilt sdk container %s, stderr: 
%s

What it means

After building the SDK container locally, the builder pushes it to the configured registry with 'docker push'. If the push fails (CalledProcessError), RuntimeError is raised including the image name and docker's stderr output.

Solutions

1. Read the stderr in the message for the docker push failure reason
2. Run 'docker login' against the target registry (e.g. gcloud auth configure-docker)
3. Verify the registry push URL and image/repository name are correct
4. Check network access to the registry endpoint and retry

Example fix

// before
subprocess.run(['docker', 'push', image], check=True)  # denied: unauthenticated
// after
gcloud auth configure-docker   # or: docker login <registry>
docker push <image>

import subprocess
reg = 'us-docker.pkg.dev'
assert subprocess.run(['docker', 'pull', f'{reg}/<project>/<repo>/probe:latest'], capture_output=True).returncode in (0, 1), 'registry unreachable or unauthenticated'

def registry_auth_ok(registry: str) -> bool:
    import subprocess
    r = subprocess.run(['docker', 'login', registry], capture_output=True)
    return r.returncode == 0

try:
    builder.build_container_image(...)
except RuntimeError as e:
    if 'Failed to push prebuilt sdk container' in str(e):
        logger.error('docker push failed, run docker login and retry:\n%s', e)
        raise SystemExit(5)

When it happens

Trigger: _invoke_docker_build_and_push runs 'docker push <container_image_name>' with check=True against self._docker_registry_push_url and the push exits nonzero: not authenticated, registry unreachable, or repository name invalid.

Common situations: Not logged in to the registry (docker login missing/expired token); pushing to Artifact Registry/GCR without docker auth configured; network/firewall blocking the registry; wrong registry URL or repo naming.

Related errors

• Failed to build sdk container with local docker, stderr
• GCP Authentication Extension not configured properly
• No proto encoding for PaneInfoCoder, always part of…
• project and location must be None if api_key is set
• project and location must both be provided if api_key is…

AI-assisted analysis of apache/beam@12126d8942 (2026-09-13). Data as JSON: /api/errors/d304bcd762deab5b. Report an issue: GitHub.

Appendix: source

Thrown at sdks/python/apache_beam/runners/portability/sdk_container_builder.py:186

      now = time.time()
      subprocess.run(['docker', 'build', '.', '-t', container_image_name],
                     check=True,
                     cwd=self._temp_src_dir)
    except subprocess.CalledProcessError as err:
      raise RuntimeError(
          'Failed to build sdk container with local docker, '
          'stderr:\n %s.' % err.stderr)
    else:
      _LOGGER.info(
          "Successfully built %s in %.2f seconds" %
          (container_image_name, time.time() - now))

    if self._docker_registry_push_url:
      _LOGGER.info("Pushing prebuilt sdk container...")
      try:
        subprocess.run(['docker', 'push', container_image_name], check=True)
      except subprocess.CalledProcessError as err:
        raise RuntimeError(
            'Failed to push prebuilt sdk container %s, stderr: \n%s' %
            (container_image_name, err.stderr))
      _LOGGER.info(
          "Successfully pushed %s in %.2f seconds" %
          (container_image_name, time.time() - now))
    else:
      _LOGGER.info(
          "no --docker_registry_push_url option is specified in pipeline "
          "options, specify it if the new image is intended to be "
          "pushed to a registry.")


class _SdkContainerImageCloudBuilder(SdkContainerImageBuilder):
  """SdkContainerLocalBuilder builds the sdk container image with google cloud
  build."""
  def __init__(self, options):
    super().__init__(options)
    self._google_cloud_options = options.view_as(GoogleCloudOptions)

View on GitHub (pinned to 12126d8942)