{"record":{"id":"d304bcd762deab5b","repo":"apache/beam","slug":"failed-to-push-prebuilt-sdk-container-s-stderr-s","errorCode":null,"errorMessage":"Failed to push prebuilt sdk container %s, stderr: \n%s","messagePattern":"Failed to push prebuilt sdk container (.+?), stderr: \n(.+?)","errorType":"exception","errorClass":"RuntimeError","httpStatus":null,"severity":"error","filePath":"sdks/python/apache_beam/runners/portability/sdk_container_builder.py","lineNumber":186,"sourceCode":"      now = time.time()\n      subprocess.run(['docker', 'build', '.', '-t', container_image_name],\n                     check=True,\n                     cwd=self._temp_src_dir)\n    except subprocess.CalledProcessError as err:\n      raise RuntimeError(\n          'Failed to build sdk container with local docker, '\n          'stderr:\\n %s.' % err.stderr)\n    else:\n      _LOGGER.info(\n          \"Successfully built %s in %.2f seconds\" %\n          (container_image_name, time.time() - now))\n\n    if self._docker_registry_push_url:\n      _LOGGER.info(\"Pushing prebuilt sdk container...\")\n      try:\n        subprocess.run(['docker', 'push', container_image_name], check=True)\n      except subprocess.CalledProcessError as err:\n        raise RuntimeError(\n            'Failed to push prebuilt sdk container %s, stderr: \\n%s' %\n            (container_image_name, err.stderr))\n      _LOGGER.info(\n          \"Successfully pushed %s in %.2f seconds\" %\n          (container_image_name, time.time() - now))\n    else:\n      _LOGGER.info(\n          \"no --docker_registry_push_url option is specified in pipeline \"\n          \"options, specify it if the new image is intended to be \"\n          \"pushed to a registry.\")\n\n\nclass _SdkContainerImageCloudBuilder(SdkContainerImageBuilder):\n  \"\"\"SdkContainerLocalBuilder builds the sdk container image with google cloud\n  build.\"\"\"\n  def __init__(self, options):\n    super().__init__(options)\n    self._google_cloud_options = options.view_as(GoogleCloudOptions)","sourceCodeStart":168,"sourceCodeEnd":204,"githubUrl":"https://github.com/apache/beam/blob/12126d8942aaf848030c478b4c6a28c6af861c66/sdks/python/apache_beam/runners/portability/sdk_container_builder.py#L168-L204","documentation":"After building the SDK container locally, the builder pushes it to the configured registry with 'docker push'. If the push fails (CalledProcessError), RuntimeError is raised including the image name and docker's stderr output.","triggerScenarios":"_invoke_docker_build_and_push runs 'docker push <container_image_name>' with check=True against self._docker_registry_push_url and the push exits nonzero: not authenticated, registry unreachable, or repository name invalid.","commonSituations":"Not logged in to the registry (docker login missing/expired token); pushing to Artifact Registry/GCR without docker auth configured; network/firewall blocking the registry; wrong registry URL or repo naming.","solutions":["Read the stderr in the message for the docker push failure reason","Run 'docker login' against the target registry (e.g. gcloud auth configure-docker)","Verify the registry push URL and image/repository name are correct","Check network access to the registry endpoint and retry"],"exampleFix":"// before\nsubprocess.run(['docker', 'push', image], check=True)  # denied: unauthenticated\n// after\ngcloud auth configure-docker   # or: docker login <registry>\ndocker push <image>","handlingStrategy":"validation","validationCode":"import subprocess\nreg = 'us-docker.pkg.dev'\nassert subprocess.run(['docker', 'pull', f'{reg}/<project>/<repo>/probe:latest'], capture_output=True).returncode in (0, 1), 'registry unreachable or unauthenticated'","typeGuard":"def registry_auth_ok(registry: str) -> bool:\n    import subprocess\n    r = subprocess.run(['docker', 'login', registry], capture_output=True)\n    return r.returncode == 0","tryCatchPattern":"try:\n    builder.build_container_image(...)\nexcept RuntimeError as e:\n    if 'Failed to push prebuilt sdk container' in str(e):\n        logger.error('docker push failed, run docker login and retry:\\n%s', e)\n        raise SystemExit(5)","preventionTips":["Run docker login / gcloud auth configure-docker before pipelines that push images","Verify the registry push URL matches an existing repository you can write to","Check token expiry in long-running CI sessions and re-authenticate"],"tags":["apache-beam","docker","registry-push","authentication"],"backgroundTag":"authentication-required","analyzedSha":"12126d8942aaf848030c478b4c6a28c6af861c66","analyzedAt":"2026-09-13T01:50:10.254Z","contentChangedAt":"2026-09-13T01:50:10.254Z","schemaVersion":2},"datasetVersion":"2026-09-20T03:17:13.778Z"}