Permission denied on docker pull from Google Cloud Compute - docker

Question

So I set up a minimal Google Cloud Compute instance with terraform and want to use a docker image on it. The desired image is pushed to an artifact repository in the same project.
Error
The issue is that whatever I do, when trying to pull with the pull command specified in the artifact repo, I get:
sudo docker pull europe-west3-docker.pkg.dev/[project]/[repo]/[image]:latest
Error response from daemon:
Head "https://europe-west3-docker.pkg.dev/v2/[project]/[repo]/api/manifests/latest": denied:
Permission "artifactregistry.repositories.downloadArtifacts" denied on resource "projects/[project]/locations/europe-west3/repositories/[repo]" (or it may not exist)
Debugging attempts
What I've tried:
The default service account should have access without any additional setup. To debug and make sure nothing goes wrong, I tried creating a service account with the necessary role myself.
Tried to debug access with the policy troubleshooting tool, access should be possible
Made sure to enable docker auth with gcloud auth configure-docker europe-west3-docker.pkg.dev and debugged the used account with gcloud auth list.
Tried the pull command on my local machine, works flawlessly
Tried to access the repo via gcloud artifacts docker images list [repo], works fine as well
Tried to run gcloud init
Tried pulling images from the official docker repo, also works flawlessly
Terraform code for reference
#
# INSTANCE
#
resource "google_compute_instance" "mono" {
name = "mono"
machine_type = "n1-standard-1"
allow_stopping_for_update = true # allows hard updating
service_account {
scopes = ["cloud-platform"]
}
boot_disk {
initialize_params {
image = "debian-cloud/debian-11"
}
}
network_interface {
network = "default"
access_config {
}
}
}
#
# REPO
#
resource "google_artifact_registry_repository" "repo" {
location = var.location
repository_id = var.project_name
format = "DOCKER"
}

Answer 1

Solution
After wasting too many hours on this, I found that after adding my user to the docker group and thus running docker without sudo, it suddenly works.
So as laid out here: https://docs.docker.com/engine/install/linux-postinstall/
sudo groupadd docker
sudo usermod -aG docker $USER
# exit and login again via ssh
Explanation
As per the docs:
Note: If you normally run Docker commands on Linux with sudo, Docker looks for Artifact Registry credentials in /root/.docker/config.json instead of $HOME/.docker/config.json. If you want to use sudo with docker commands instead of using the Docker security group, configure credentials with sudo gcloud auth configure-docker instead.
So if you use docker with sudo, you also need to run
sudo gcloud auth configure-docker
I thought I had tried this, but it is what it is...