{"record":{"id":"ef2b21c87307207c","repo":"GoogleContainerTools/jib","slug":"helpfulsuggestions-forhttpstatuscodeforbidden-re","errorCode":null,"errorMessage":"${helpfulSuggestions.forHttpStatusCodeForbidden(registryUnauthorizedException.getImageReference())}","messagePattern":"\\$\\{helpfulSuggestions\\.forHttpStatusCodeForbidden\\(registryUnauthorizedException\\.getImageReference\\(\\)\\)\\}","errorType":"exception","errorClass":"BuildStepsExecutionException","httpStatus":403,"severity":"error","filePath":"jib-plugins-common/src/main/java/com/google/cloud/tools/jib/plugins/common/JibBuildRunner.java","lineNumber":176,"sourceCode":"      HelpfulSuggestions helpfulSuggestions,\n      Path outputPath) {\n    return new JibBuildRunner(\n        jibContainerBuilder,\n        containerizer,\n        logger,\n        helpfulSuggestions,\n        String.format(STARTUP_MESSAGE_FORMAT_FOR_TARBALL, outputPath.toString()),\n        String.format(SUCCESS_MESSAGE_FORMAT_FOR_TARBALL, outputPath.toString()));\n  }\n\n  private static void handleRegistryUnauthorizedException(\n      RegistryUnauthorizedException registryUnauthorizedException,\n      HelpfulSuggestions helpfulSuggestions)\n      throws BuildStepsExecutionException {\n    if (registryUnauthorizedException.getHttpResponseException().getStatusCode()\n        == HttpStatusCodes.STATUS_CODE_FORBIDDEN) {\n      // No permissions for registry/repository.\n      throw new BuildStepsExecutionException(\n          helpfulSuggestions.forHttpStatusCodeForbidden(\n              registryUnauthorizedException.getImageReference()),\n          registryUnauthorizedException);\n\n    } else {\n      throw new BuildStepsExecutionException(\n          helpfulSuggestions.forNoCredentialsDefined(\n              registryUnauthorizedException.getImageReference()),\n          registryUnauthorizedException);\n    }\n  }\n\n  private final String startupMessage;\n  private final String successMessage;\n  private final JibContainerBuilder jibContainerBuilder;\n  private final Containerizer containerizer;\n  private final Consumer<LogEvent> logger;\n  private final HelpfulSuggestions helpfulSuggestions;","sourceCodeStart":158,"sourceCodeEnd":194,"githubUrl":"https://github.com/GoogleContainerTools/jib/blob/fb949e2676afbbd7dd7a1ef61e20251931325654/jib-plugins-common/src/main/java/com/google/cloud/tools/jib/plugins/common/JibBuildRunner.java#L158-L194","documentation":"JibBuildRunner.handleRegistryUnauthorizedException converts a 403 Forbidden from a registry into a BuildStepsExecutionException carrying HelpfulSuggestions.forHttpStatusCodeForbidden(imageReference). This means Jib authenticated (or attempted to) but was denied access to the registry or repository — typically because the account lacks push/pull permission for that image path.","triggerScenarios":"During runBuild, the registry returns HTTP 403 for the target image — e.g. pushing to a registry/repository the authenticated user has no write access to, or pulling a private image with a read-only account.","commonSituations":"Wrong image repository path/namespace; expired or limited-scope service account (GCP, AWS ECR); pushing to an organization you're not a member of; using `docker login` credentials of another user.","solutions":["Verify the image reference (registry/repository) is spelled correctly and you own/have access to it.","Run `docker login <registry>` with an account that has push/pull rights, or configure jib.to.auth/from.auth explicitly.","For cloud registries, check IAM permissions (e.g. Artifact Registry Writer, ECR push policy) and refresh tokens (`gcloud auth login`, `aws ecr get-login-password`).","Test manually: `docker pull`/`docker push` the same image path to confirm the permission problem is registry-side."],"exampleFix":"// before (403 from wrong namespace)\njib.to.image = \"gcr.io/my-project-123/app\"\n// after (correct project with access)\njib.to.image = \"gcr.io/my-actual-project/app\"","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try { jibBuild() } catch (BuildStepsExecutionException e) {\n  if (e.getCause() instanceof RegistryUnauthorizedException\n      && ((RegistryUnauthorizedException) e.getCause()).getHttpResponseException().getStatusCode() == 403) {\n    // permissions problem on registry/repository — fix IAM or image path\n  }\n}","preventionTips":["Verify registry IAM/push permissions before CI builds","Run `docker push` manually once to confirm access","Keep cloud auth fresh (gcloud auth login / aws ecr get-login-password)","Double-check the image repository path and namespace"],"tags":["docker","registry","permissions","http"],"backgroundTag":"permission-denied","analyzedSha":"fb949e2676afbbd7dd7a1ef61e20251931325654","analyzedAt":"2026-09-06T14:04:09.491Z","contentChangedAt":"2026-09-06T14:04:09.491Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}