{"record":{"id":"4a856885a581ddef","repo":"hashicorp/nomad","slug":"failed-to-find-docker-auth-for-repo-q-v","errorCode":null,"errorMessage":"Failed to find docker auth for repo %q: %v","messagePattern":"Failed to find docker auth for repo %q: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"drivers/docker/driver.go","lineNumber":661,"sourceCode":"\t}\n\n\t// Load the image if specified\n\tif driverConfig.LoadImage != \"\" {\n\t\treturn d.loadImage(task, driverConfig, client)\n\t}\n\n\t// Download the image\n\treturn d.pullImage(task, driverConfig, repo, tag)\n}\n\n// pullImage creates an image by pulling it from a docker registry\nfunc (d *Driver) pullImage(task *drivers.TaskConfig, driverConfig *TaskConfig, repo, tag string) (id, user string, err error) {\n\tauthOptions, err := d.resolveRegistryAuthentication(driverConfig, repo)\n\tif err != nil {\n\t\tif driverConfig.AuthSoftFail {\n\t\t\td.logger.Warn(\"Failed to find docker repo auth\", \"repo\", repo, \"error\", err)\n\t\t} else {\n\t\t\treturn \"\", \"\", fmt.Errorf(\"Failed to find docker auth for repo %q: %v\", repo, err)\n\t\t}\n\t}\n\n\tif authIsEmpty(authOptions) {\n\t\td.logger.Debug(\"did not find docker auth for repo\", \"repo\", repo)\n\t}\n\n\td.eventer.EmitEvent(&drivers.TaskEvent{\n\t\tTaskID:    task.ID,\n\t\tAllocID:   task.AllocID,\n\t\tTaskName:  task.Name,\n\t\tTimestamp: time.Now(),\n\t\tMessage:   \"Downloading image\",\n\t\tAnnotations: map[string]string{\n\t\t\t\"image\": dockerImageRef(repo, tag),\n\t\t},\n\t})\n","sourceCodeStart":643,"sourceCodeEnd":679,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/drivers/docker/driver.go#L643-L679","documentation":"pullImage fails when resolveRegistryAuthentication cannot find credentials for the image repository and AuthSoftFail is not set. Docker requires auth for private registries, so without credentials the pull cannot proceed. This is thrown before any network pull is attempted.","triggerScenarios":"Task pulls from a private registry while no docker auth config exists (no DOCKER_AUTH_CONFIG in task config, no DockerConfigHelper/auth helper on the client, no dockerd credential store), and driverConfig.AuthSoftFail is false.","commonSituations":"Pulling from a private ECR/GCR/Artifactory registry without configured credentials, expired registry credentials, missing docker.config on the Nomad client, or moving an image from Docker Hub to a private registry without updating auth.","solutions":["Add registry credentials via the task driver config auth block (auth.username/password, auth_email) or DOCKER_AUTH_CONFIG.","Configure the client's docker config file (~/.docker/config.json) or Nomad's DockerAuthConfig option so the helper can locate credentials.","For ECR, enable the ECR credential helper / set GC to refresh credentials.","If auth is optional for this image, set auth_soft_fail = true so the driver warns instead of failing."],"exampleFix":"// before\nconfig {\n  image = \"private.registry/app:1.0\"\n}\n// after\nconfig {\n  image = \"private.registry/app:1.0\"\n  auth {\n    username = \"user\"\n    password = \"pass\"\n    server_address = \"private.registry\"\n  }\n}","handlingStrategy":"validation","validationCode":"// pre-check credentials exist before job submit\nif strings.Contains(cfg.Image, \"private.registry\") && cfg.Auth == nil {\n\tlog.Fatal(\"private registry image requires docker auth config\")\n}","typeGuard":null,"tryCatchPattern":"// soft-fail alternative\nif err != nil {\n\tif strings.Contains(err.Error(), \"Failed to find docker auth\") && cfg.AuthSoftFail {\n\t\tlogger.Warn(\"continuing without registry auth\", \"err\", err)\n\t} else {\n\t\treturn err\n\t}\n}","preventionTips":["Configure DOCKER_AUTH_CONFIG or client docker config before deploying private images","Rotate and test registry credentials periodically","Use auth_soft_fail only when images may also be public","For ECR/GCR use the vendor credential helpers"],"tags":["docker","auth","registry"],"backgroundTag":"registry-auth-not-found","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}