{"record":{"id":"d1d134327ac5c372","repo":"GoogleContainerTools/skaffold","slug":"pulling-image-from-repository-w","errorCode":null,"errorMessage":"pulling image from repository: %w","messagePattern":"pulling image from repository: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/skaffold/docker/image.go","lineNumber":550,"sourceCode":"\t\t\tVariant:      platform.Variant,\n\t\t})\n\t}\n\n\trc, err := l.apiClient.ImagePull(ctx, ref, client.ImagePullOptions{\n\t\tRegistryAuth: registryAuth,\n\t\tPrivilegeFunc: func(ctx context.Context) (string, error) {\n\t\t\t// The first pull is unauthorized. There are two situations:\n\t\t\t//   1. if `encodedRegistryAuth()` errored, then `registryAuth == \"\"` and so we've\n\t\t\t//     tried an anonymous pull which has failed.  So return the original error from\n\t\t\t//     `encodedRegistryAuth()`.\n\t\t\t//   2. If `encodedRegistryAuth()` succeeded (so `err == nil`), then our credential was rejected, so\n\t\t\t//     return \"\" to retry as an anonymous pull.\n\t\t\treturn \"\", err\n\t\t},\n\t\tPlatforms: platforms,\n\t})\n\tif err != nil {\n\t\treturn fmt.Errorf(\"pulling image from repository: %w\", err)\n\t}\n\tdefer rc.Close()\n\n\treturn streamDockerMessages(out, rc, nil)\n}\n\n// Load loads an image from a tar file. Returns the imageID for the loaded image.\nfunc (l *localDaemon) Load(ctx context.Context, out io.Writer, input io.Reader, ref string) (string, error) {\n\tresp, err := l.apiClient.ImageLoad(ctx, input)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"loading image into docker daemon: %w\", err)\n\t}\n\tdefer resp.Close()\n\n\tif err := streamDockerMessages(out, resp, nil); err != nil {\n\t\treturn \"\", fmt.Errorf(\"reading from image load response: %w\", err)\n\t}\n","sourceCodeStart":532,"sourceCodeEnd":568,"githubUrl":"https://github.com/GoogleContainerTools/skaffold/blob/a1189de023efc32d4b8e11f395acc678aa555011/pkg/skaffold/docker/image.go#L532-L568","documentation":"localDaemon.Pull wraps errors from apiClient.ImagePull — the initial registry request to start the pull failed. The function already retried with and without credentials (PrivilegeFunc), so this error means both authenticated and anonymous pull attempts failed. The underlying cause (auth, not-found, network, platform mismatch) is preserved via %w.","triggerScenarios":"Calling Pull(ctx, out, ref, platform) when the registry refuses the pull: image does not exist, no credentials and image is private, both sets of credentials rejected, or the requested platform has no matching manifest.","commonSituations":"Pulling a private image whose credentials were never configured (`gcloud auth configure-docker`, `docker login`), typo in image tag, image only built for linux/amd64 while pulling for linux/arm64, corporate proxy blocking the registry.","solutions":["Authenticate for the registry: `docker login <registry>` or the cloud equivalent (`gcloud auth configure-docker`, `aws ecr get-login`).","Verify the image/tag exists: `docker manifest inspect <ref>`.","Check that the requested platform (os/arch) has a matching manifest, or drop the platform constraint.","Test connectivity to the registry (`curl https://<registry>/v2/`) and check proxy/VPN settings."],"exampleFix":"// before: unauthenticated pull of private image fails\nskaffold dev\n// after\ngcloud auth configure-docker && skaffold dev","handlingStrategy":"validation","validationCode":"// pre-flight: does the reference exist and is auth set up?\nif _, err := client.DistributionInspect(ctx, ref, opts); err != nil {\n    return fmt.Errorf(\"image %q not reachable; run `docker login <registry>`: %w\", ref, err)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Configure credential helpers for all private registries used by the project.","Validate image tags/refs against `docker manifest inspect` in CI before deployment.","Confirm multi-arch manifests cover the platform you request.","Test registry connectivity through corporate proxies/VPNs."],"tags":["docker","registry","pull","auth"],"backgroundTag":"docker-pull-access-denied","analyzedSha":"a1189de023efc32d4b8e11f395acc678aa555011","analyzedAt":"2026-09-05T12:09:27.064Z","contentChangedAt":"2026-09-05T12:09:27.064Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}