{"record":{"id":"6e8591e87eb8e65a","repo":"GoogleContainerTools/skaffold","slug":"s-q-w","errorCode":null,"errorMessage":"%s %q: %w","messagePattern":"(.+?) %q: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/skaffold/docker/image.go","lineNumber":441,"sourceCode":"}\n\n// Push pushes an image reference to a registry. Returns the image digest.\nfunc (l *localDaemon) Push(ctx context.Context, out io.Writer, ref string) (string, error) {\n\tregistryAuth, err := l.encodedRegistryAuth(ctx, DefaultAuthHelper, ref)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"getting auth config for %q: %w\", ref, err)\n\t}\n\n\t// Quick check if the image was already pushed (ignore any error).\n\tif alreadyPushed, digest, err := l.isAlreadyPushed(ctx, ref, registryAuth); alreadyPushed && err == nil {\n\t\treturn digest, nil\n\t}\n\n\trc, err := l.apiClient.ImagePush(ctx, ref, client.ImagePushOptions{\n\t\tRegistryAuth: registryAuth,\n\t})\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"%s %q: %w\", sErrors.PushImageErr, ref, err)\n\t}\n\tdefer rc.Close()\n\n\tvar digest string\n\tauxCallback := func(msg jsonstream.Message) {\n\t\tif msg.Aux == nil {\n\t\t\treturn\n\t\t}\n\n\t\tvar result PushResult\n\t\tif err := json.Unmarshal(*msg.Aux, &result); err != nil {\n\t\t\tlog.Entry(ctx).Debug(\"Unable to parse push output:\", err)\n\t\t\treturn\n\t\t}\n\t\tdigest = result.Digest\n\t}\n\n\tif err := streamDockerMessages(out, rc, auxCallback); err != nil {","sourceCodeStart":423,"sourceCodeEnd":459,"githubUrl":"https://github.com/GoogleContainerTools/skaffold/blob/a1189de023efc32d4b8e11f395acc678aa555011/pkg/skaffold/docker/image.go#L423-L459","documentation":"The ImagePush call itself failed — the daemon rejected or could not start the push (e.g. `denied`, `not found`, or connection error). Skaffold wraps it with the semantic error key sErrors.PushImageErr and the offending ref, so the message reads like `pushing image \"ref\": <daemon error>`.","triggerScenarios":"l.apiClient.ImagePush(ctx, ref, opts) returns an error: the registry denied access (bad/expired credentials), the repository does not exist or lacks permissions, the ref is invalid, or the daemon cannot reach the registry (network/DNS/TLS).","commonSituations":"Pushing to a namespace without write permission; repository name case mismatch (Docker Hub requires lowercase); expired cloud registry tokens; corporate proxy blocking the registry; typo in the image ref.","solutions":["Read the wrapped daemon error — `denied` means fix auth/permissions, `not found` means fix the ref/repo","Re-login to the registry (`docker login <registry>`) to refresh credentials","Verify the image ref is valid and lowercase for registries that require it","Check network/proxy/TLS access to the registry from the Docker host","Confirm your account has push permission to the target repository"],"exampleFix":"// before\nimage: MyOrg/MyApp:latest   # uppercase rejected by Docker Hub\n// after\nimage: myorg/myapp:latest","handlingStrategy":"retry","validationCode":"if strings.ContainsAny(ref, \"ABCDEFGHIJKLMNOPQRSTUVWXYZ\") {\n\treturn fmt.Errorf(\"image ref must be lowercase for most registries: %s\", ref)\n}","typeGuard":null,"tryCatchPattern":"digest, err := daemon.Push(ctx, out, ref)\nif err != nil && strings.Contains(err.Error(), sErrors.PushImageErr) {\n\t// inspect wrapped daemon error: denied -> re-auth; not found -> fix ref\n\tif strings.Contains(err.Error(), \"denied\") {\n\t\t// refresh credentials then retry once\n\t}\n\treturn fmt.Errorf(\"push failed for %s: %w\", ref, err)\n}","preventionTips":["Use lowercase image names for Docker Hub and similar registries","Confirm write permissions on the target repository before pushing","Refresh cloud registry tokens on a schedule in CI","Verify registry reachability (DNS/proxy/TLS) from the Docker host"],"tags":["docker","push","registry"],"backgroundTag":"image-push-denied","analyzedSha":"a1189de023efc32d4b8e11f395acc678aa555011","analyzedAt":"2026-09-05T12:09:27.064Z","contentChangedAt":"2026-09-05T12:09:27.064Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}