{"record":{"id":"3845a17cd1f1c5ac","repo":"GoogleContainerTools/skaffold","slug":"s-q-w-3845a1","errorCode":null,"errorMessage":"%s %q: %w","messagePattern":"(.+?) %q: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/skaffold/docker/remote.go","lineNumber":114,"sourceCode":"\t}\n\n\treturn img.ConfigFile()\n}\n\n// Push pushes the tarball image\nfunc Push(tarPath, tag string, cfg Config, platforms []specs.Platform) (string, error) {\n\tt, err := name.NewTag(tag, name.WeakValidation)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"parsing tag %q: %w\", tag, err)\n\t}\n\n\ti, err := tarball.ImageFromPath(tarPath, nil)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"reading image %q: %w\", tarPath, err)\n\t}\n\n\tif err := remote.Write(t, i, remote.WithAuthFromKeychain(primaryKeychain)); err != nil {\n\t\treturn \"\", fmt.Errorf(\"%s %q: %w\", sErrors.PushImageErr, t, err)\n\t}\n\n\treturn getRemoteDigest(tag, cfg, platforms)\n}\n\nfunc getRemoteImage(identifier string, cfg Config, platform v1.Platform) (v1.Image, error) {\n\tref, err := parseReference(identifier, cfg)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\toptions := []remote.Option{\n\t\tremote.WithAuthFromKeychain(primaryKeychain),\n\t}\n\tif IsInsecure(ref, cfg.GetInsecureRegistries()) {\n\t\toptions = append(options, insecureTransportOption())\n\t}\n\tif platform.String() != \"\" {\n\t\toptions = append(options, remote.WithPlatform(platform))","sourceCodeStart":96,"sourceCodeEnd":132,"githubUrl":"https://github.com/GoogleContainerTools/skaffold/blob/a1189de023efc32d4b8e11f395acc678aa555011/pkg/skaffold/docker/remote.go#L96-L132","documentation":"Push fails with \"<PushImageErr> %q\" (sErrors.PushImageErr, typically \"pushing image\") when remote.Write cannot upload the loaded tarball image to the target registry. This wraps go-containerregistry's remote.Write error — auth failures, TLS problems, connectivity, blob upload errors, or registry denial (quota, permissions).","triggerScenarios":"remote.Write to the parsed tag fails: unauthenticated/unauthorized (401/403), registry unreachable, insecure registry without skip-verify configured, image exceeds repo size limits, or tag already protected.","commonSituations":"docker login never run for the registry or token expired; GCR/Artifact Registry permissions missing on the service account; corporate proxy blocking the upload; pushing to a read-only mirror.","solutions":["Authenticate: `docker login <registry>` (or configure the proper credential helper for gcloud/aws/ecr) and retry.","Read the wrapped error — a 401/403 indicates credentials/permissions; DENIED indicates repo policy; timeout indicates network/proxy.","Verify push permission on the target repository/project (IAM, or repo-level ACLs in Harbor/Quay).","If the registry is HTTP or has a self-signed cert, add it to insecure_registries in the Skaffold config.","Check registry-side limits (quota, rate limits, image size) and egress/proxy settings."],"exampleFix":"// before\ndocker.Push(tarPath, \"us.gcr.io/proj/app:v1\", cfg, nil) // 403 DENIED\n// after\n# grant push access / login first\n# gcloud auth activate-service-account --key-file=sa.json\n# gcloud auth configure-docker us.gcr.io\ndocker.Push(tarPath, \"us.gcr.io/proj/app:v1\", cfg, nil)","handlingStrategy":"try-catch","validationCode":"func canPush(ref string) error {\n\trepo, err := name.NewRepository(ref, name.WeakValidation)\n\tif err != nil { return err }\n\t_, err = remote.Index(repo, remote.WithAuthFromKeychain(defaultKeychain())) // auth smoke test\n\tif err != nil {\n\t\tvar te *transport.Error\n\t\tif errors.As(err, &te) && (te.StatusCode == 401 || te.StatusCode == 403) {\n\t\t\treturn fmt.Errorf(\"no push credentials/permissions for %s\", ref)\n\t\t}\n\t}\n\treturn nil\n}","typeGuard":"func hasRegistryAuth(registry string) bool {\n\tcfg, err := config.Load()\n\tif err != nil { return false }\n\tauth, err := cfg.GetAuth(registry)\n\treturn err == nil && auth != authn.Anonymous\n}","tryCatchPattern":"if _, err := docker.Push(tarPath, tag, cfg, platforms); err != nil {\n\tvar te *transport.Error\n\tif errors.As(err, &te) {\n\t\tswitch te.StatusCode {\n\t\tcase 401, 403: return fmt.Errorf(\"run `docker login %s` and verify push permissions\", registryOf(tag))\n\t\tcase http.StatusGatewayTimeout: return fmt.Errorf(\"registry timeout; check network/proxy\")\n\t\t}\n\t}\n\treturn err\n}","preventionTips":["Script docker login (or cloud credential-helper config) before any push in CI.","Verify repository IAM/ACL push rights for the identity in use.","Add self-signed/HTTP registries to insecure_registries ahead of time.","Inspect the wrapped transport error status to choose auth vs network remediation."],"tags":["docker","registry","push","auth","network"],"backgroundTag":"registry-push-denied","analyzedSha":"a1189de023efc32d4b8e11f395acc678aa555011","analyzedAt":"2026-09-05T12:09:27.064Z","contentChangedAt":"2026-09-05T12:09:27.064Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}