Docker Desktop Push of Image to Private Repo Fails - docker

I have Docker Desktop, but create my images on a Linux ARM64 machine, not the MacBook with the Docker Desktop application on it. I want to push these ARM64 images from the Linux host itself, but have run into the following problem:
When I push my image to my Docker Hub private repo with the command:
docker push myDockerHubUserName/myPrivateRepoName:tagOfImage
It fails with the error:
invalid reference format
The form of the command Docker has provided in my Docker account is described as:
Docker commands
To push a new tag to this repository,
docker push myDockerHubUserName/myPrivateRepoName:tagname
I've double-checked the values and syntax: ALL are 100% correct. But the push nonetheless fails.
How is this broken?!?!

Intro:
The error:
invalid reference format
is actually a red herring that will mislead you into believing that there is a syntax error in your push command when there isn't and you'll waste your time...
Problem:
Feel free to jump to the "SOLUTION" section below if you don't care how the commands fails and just want to know how to make it execute successfully ;-)
The instructions for pushing the image that Docker provides in their user's accounts have some large & material gaps. You will waste your time- a fair bit of it- if you do not have the following context:
You must login to your Docker Account before trying to push anything to it:
docker login -u yourDockerAccountUsername
The command Docker Hub gives you implies that the image you're trying to push was already TAGGED with the private repo as part of the tag itself.
It just appears to be a string comprised of (3) parts:
<dockerUserName>/<privateRepoName>:<tagname>It is NOT. You CANNOT merely concatenate
"myDockerHubUserName/myPrivateRepoName"
with
"tagname"
delimited with a colon! "myDockerHubUserName/myPrivateRepoName" must itself be part of the tag or the command will fail!!!
This "help" from Docker I found to be worse than giving no "help" at all because it served to create undue confusion. This is absolutely fundamental stuff and deserves better treatment.
Solution:
Login to your Docker Account:
docker login -u yourDockerAccountUsername
Get the Image ID for the Image that you want to push:
docker image ls
Tag the image with your Docker Hub User ID, Docker Hub Repo Name AND Image Name:
docker tag ae1b95b73ef7 myDockerHubUserName/myPrivateRepoName:myImageName
Push the Image:
docker push myDockerHubUserName/myPrivateRepoName:myImageName
Note the COLON separating the repo & image name: I've seen this described as a forward slash in other answers but I found a colon is required for the command to succeed.
Conclusion:
This was a big and unnecessary time-waster that sent me down the rabbit hole. Hopefully this answer will save others wasted time.
Attribution:
This answer was actually pieced together from several different Stack questions which got me across the finish line. Kudos to Abhishek Dasgupta for the general procedure & kudos to Илья Хоришко for the form of the tag which worked in the end. You folks are stars!

Related

docker - how to hide build arguments

I've recently started to use docker far and wide for my professional projects. I'm still getting to grips with many of the details.
So far, when trying to acquire a software package from a repository on gitlab or github, I have gone the route of acquiring a token, putting the token in some environment variable, and passing that to docker build via the --build-arg argument and then to the git clone command.
However, as I started pushing my images to dockerhub, I was a bit shocked to find that in the "Image Layer Details" section, it displays also the value of the environment variables passed to docker build, that is, the content of my security tokens. Now, this is not so problematic because I can just revoke them and create new ones everytime I push, but that seems quite cumbersome.
Is there a good way to pass security tokens to docker build such that they don't show up in anywhere publicly?
First I want to mention that COPYing the secret (if it's a file) or using ARG (with docker build --arg) will always be visible (either by inspecting the layers or checking the image with docker history <image-id> so those options are out of the question
Docker now supports BuildKit which enables you to mount secrets during build time.
One way to do this is by adding the following statement in your Dockerfile:
RUN --mount=type=secret,id=mysecret <some_command>
and during build use:
export MYSECRET=bigsecret
DOCKER_BUILDKIT=1 docker build --secret id=mysecret,env=MYSECRET -t myimage:latest .
The secrets should be available at /run/secrets/<secret_name> by default, but you can also specify the destination yourself (check the link).

docker images are not showing in console but showing in docker hub (allow permission by someone)

I am pretty new in docker, The thing is this i have created an account to the DockerHub, then someone give me the permission to his/her private repository, i have also configure docker on my local Machine Ubuntu.
The docker images are showing on the DockerHub, as i am login through the shell also, but whenever i am try to list those images on my local machine not show any of them. i don't know at which point i am wrong. or what important point i am missing
docker image ls or docker image ls -a
Viewing private images is not supported directly from the command line according to this thread which is a little old but still no native support for your case and that's why you will notice that there are custom projects like this, the project mentioned in the following comment which can help you achieve what you need.

Pulling Docker Images - Manifest not found

I'm trying to download a tagged docker image
docker pull clkao/postgres-plv8:10-2
and, in a compose file,
postgres:
image: clkao/postgres-plv8:10-2
But receive a manifest not found exception.
Unless I'm mistaken, that tag exists in Docker Hub, however I notice that it doesn't appear on the tags list.
Am I doing something wrong? Or is this perhaps an issue with Docker Hub or the way that repo has been set up?
If it isn't 'my fault', what's a recommendation to move forward? Create my own Dockerfile perhaps?
You might also try
docker pull -a <image>.
The -a will pull all versions of that image, which at least lets you know what is there.
(This is less useful if you really need a specific version, but helped me when I tried to pull an image that for some reason did not have a 'latest' tag.)
Edit: This is actually a really bad idea, since it will pull down the entire history, which for many repositories could be many GB. Better to go look at the repository site and see what tag you want. Note to self: don't post answers when you are tired. :-(
You get the error message because there exist no tag with "10-2".
You can try to figure out why and contact the repository owner or you can try to build your own one.
I just got over this "manifest for / not found: manifest unknown: The named manifest is not known to the registry."
Using
docker login <repo>
Check the docker's image also not only that the tag exists, I was trying to run Flyway version 5.0.1 for an image flyway/flyway which version did not exist, it existed only in version flyway/flyway:latest it seems, whereas 5.0.1 existed and I pulled it but in/from a different repository name, with repository name boxfuse/flyway.
for the error message 'docker manifest unknown'
When you use docker pull, without a tag, it will default to the tag :latest. Make sure that when we are building a image add tag latest or we can access the image by the tag name after image name with colon
I think you are trying to tag your image as v8.10.2. Make sure while tagging image locally you use same tag which you want to pull in future. So steps will be like below:
docker build -t clkao/postgres-pl:v8.10.2 .
docker push clkao/postgres-pl:v8.10.2
docker pull clkao/postgres-pl:v8.10.2
If this is from Git via docker.pkg.github.com then you need to switch to use ghcr.io. The former is deprecated and does not support the manifest endpoint so some docker clients, when they attempt to download various resources, fail with this error message. If you instead publish your image to ghcr (Github Container Repository), the docker image pulling process should complete successfully.
cd <dir with Dockerfile in it>
docker build -f Dockerfile -t ghcr.io/<org_id>/<project_id>:<version> .
docker push ghcr.io/<org_id>/<project_id>:<version>
More info here: https://docs.github.com/en/packages/working-with-a-github-packages-registry/migrating-to-the-container-registry-from-the-docker-registry
Note: The Container registry is currently in public beta and subject
to change. During the beta, storage and bandwidth are free. To use the
Container registry, you must enable the feature preview. For more
information, see "Introduction to GitHub Packages" and "Enabling
improved container support with the Container registry."

docker push error "denied: requested access to the resource is denied"

This error occurs when trying to push an image to the public repository on Docker Hub. There have been no issues with other registries I have tried.
I have looked at numerous sites, blogs including StackOverflow and there is still no clear answer.
You can try to replicate this issue as follows.
As shown in the screenshot above, I have an image aspc-mvc-app on local docker host. As shown, it has 3 tags - 1.0.5, 1.0.5.latest and latest.
Assume that we are trying to push using an account name of janedoe at Docker Hub
Per documentation on Docker.io and numerous other sites, there are 3 steps to pushing.
(1) Login
docker login "index.docker.io" -u janedoe -p <password>
--> I get Login Succeeded which is good!
(2) Add one or more tags
Of the 3 tags, let's just tag the latest.
docker tag janedoe/aspc-mvc-app:latest janedoe/aspc-mvc-app
--> The prompt returns with no error. So far so good.
(3) Push
docker push janedoe/aspc-mvc-app
--> This is where the error occurs.
As shown on the screenshot below, initial checks seem to occur fine until you get the error denied: requested access to the resource is denied
At step (2), I have tried numerous other formats including the following.
docker tag janedoe/aspc-mvc-app:latest janedoe/aspc-mvc-app:latest
docker tag janedoe/aspc-mvc-app janedoe/aspc-mvc-app:latest
docker tag aspc-mvc-app:latest janedoe/aspc-mvc-app
docker tag aspc-mvc-app janedoe/aspc-mvc-app:latest
docker tag 306a8fd79d88 janedoe/aspc-mvc-app
docker tag 306a8fd79d88 janedoe/aspc-mvc-app:latest
All fail with the same error.
As a comparison, with the same exact image, I had no problem pushing to Azure Container Registry.
Since Docker Hub is so popular, can anyone shed light on what the mystery is, or if there is a detailed documentation anywhere?
Updated 5/9/2017
I am fairly up-to-date on docker cli and server versions. Right now, my cli is 17.05.0-ce-rc1 and server is 17.04.0-ce as shown below.
The solution is simply to change the way of logging in at step (1).
docker login -u janedoe -p <password>
Everything else can stay the way described above. The image was successfully pushed to Docker Hub!
First login by typing sudo docker login in the terminal. Enter username and password
Visit your docker account and create a new repository. In my case I created a repository crabigator1900/dockerhub
Say you have a docker image with repository name:crabigator/django and tag:latest.
In that case you will need to tag this image with a label of your wish. I decided to tag it with the label:myfirstimagepush. You tag the image by typing the command
sudo docker tag crabigator/django:latest crabigator1900/dockerhub:firstimagepush
Finally push the image to your repo using the command
sudo docker push crabigator1900/dockerhub:firstimagepush
That's all there is to it.
I too had the same issue, but after trying some combinations this worked.
Whenever you push - that refers to docker.io/ followed by registry path.
In my case my username is rushmith and I created a sample repository called docker under rushmith.
My link is : "hub.docker.com/r/rushmith/docker/"
Now I created a tag to my image that I want to push as: rushmith/docker
And It worked successfully.
$ docker login -u rushmith
(Give the password then type as below)
$ docker push rushmith/docker:latest
Output:
The push refers to a repository [docker.io/rushmith/docker]
7fbb0e1e64cb: Pushed
33f1a94ed7fc: Pushed
b27287a6dbce: Pushed
47c2386f248c: Pushed
2be95f0d8a0c: Pushed
2df9b8def18a: Pushed
latest: digest:
sha256:4d749d86b4a2d9304a50df474f6236140dc2d169b9aabc354cdbc6ac107390f2 size: 1569
I hope this late solution might help someone.
The reason of this error message was you haven't named your images properly.
Let say your account name on docker.io was your-name then your new repo name is going to be your-name/your-new-image-name.
In order to push your image, first you have to tag (name) your local images as:
docker tag local-image[:tag-name] your-name/your-new-image-name[:tag-name]
Things in the brackets is optional. You may want to check the result with docker image ls. Then let push your image to your docker repo:
docker push your-name/your-new-image-name[:tag-name]
Done! Your image was pushed to docker repos.
You can follow the following steps:
Step 1: docker login -u <username> -p <password>
A message with "Login Succeeded" will appear, confirming your successful login.
Step 2:
Now in order to push the image just make sure the path which you are using must have your username included in the tag.
e.g: Suppose link is: "hub.docker.com/u/xyz/"
Create a tag to image as docker push xyz/docker:latest.
If you already have some different tag change it using command
docker tag <old tag> <new tag>
Hope this helps.
after 1 hour's struggling with different ways mentioned above,
I reinstalled the neweast version of Docker Desktop app in my mbp, then it is solved.
the neweast version is 20.10.2
and the old version is 17.x, which was installed 5 years ago.
First you need to ensure you have logged into your account
You need to create a repository, below is the command to create a repository -
docker tag local-image:tagname YOUR-ACCOUNT-NAME/tagname
docker push YOUR-ACCOUNT-NAME/tagname
Create a repository from a website.
It possible that you don't have a permission for creating repository.
docker push does not create a repo name so if not present it says access not available
This worked for me.
> docker login -u janedoe
Password:
Login Succeeded
> docker tag myapp:0.0.1 janedoe/myflinkapp:0.0.1
> docker push janedoe/myapp:0.0.1
The push refers to repository [docker.io/janedoe/myapp]
b763be657a2c: Pushed
e534dae385a8: Pushed
5af3d5d57035: Pushed
0e44828b51e2: Pushed
fdd771f27095: Pushed
ef9a7b8862f4: Pushed
a1f2f42922b1: Pushed
4762552ad7d8: Pushed
0.0.1: digest: sha256:0069ee2c39b422e64f0493d2b2e9cbe7736a size: 2154
In my case, I was facing this issue even after logging into Docker registry successfully.
So, I tried running the docker push as sudo and it worked.
Make sure you follow these steps:
Run docker login
After logging in successfully, run the docker push command
If the push failed, run this: sudo docker push repoName:tagName
If you're using 2FA and run
docker login -u <your_docker_user_name>
you will get Login successful but you won't be able to push.
This is because you're using 2FA which requires one-time password to login into your account.
To be able to push with 2FA enabled you need to use an access token. To generate one go to Account settings/Security on Docker Hub website and click New Access Token. As of Access Permissions preferably choose Read & Write - this is the entry level for being able to push. Only generate Read, Write, Delete token if you really need it!
You'll be prompted with instructions on what to do next. Just to keep the answer full, you'll have to run
docker login -u <you_docker_username>
and when prompted for Password paste your Personal Access Token.
IMPORTANT: save your Personal Access Token in a password manager and never share with anyone and never push to github or add to your source code. NEVER! Please.
Now, when you run docker push <your_docker_username>/<your_docker_repo_name>:<tag_of_your_image> you should be able to push the image to the Docker Hub.
I have the same problem and it was solved by running the push command with sudo. I think it is only a privilege problem.
sudo docker push janedoe/aspc-mvc-app

Docker build tag repository name

One can easily build docker images through docker build command.
What I'm wondering is the t flag that you can give when building the image. For example:
$ docker build -t ouruser/sinatra:v2 .
According to documentation, the t flag is for tagging and naming purposes. Name is the part before ':', and tag is the part after it. So in our example, the name is ouruser/sinatra, and the tag is v2.
I thought this would be the image name and tag. But apparently, the name is actually some repository name? Why do I think it is? Well, because if you would after this list the images with command:
docker images
You would get a listing like this:
REPOSITORY TAG IMAGE ID CREATED SIZE
ouruser/sinatra latest 5db5f8471261 11 hours ago 446.7 M
Bang! Major shock! You thought you were creating an image with name, and instead, you specified some repository! Related to this, I have some questions:
Where is this repository located?
Can I name the image without creating a repository?
Where and how is this repository used, or could be used?
Where can I find more information about this repository? I only found this, and it doesn't tell much to be honest: docker build docs
Why is it common to use names that consist of two parts like this: somename/someothername?
Thank you for your help!
I believe the confusion here is the word "repository." In Docker, a repository is any group of builds of an image with the same name, and potentially multiple tags. A "registry" server, like hub.docker.com or your own private registry, holds multiple repositories, e.g. the redis repository on the public registry. That one repository has multiple tags for different versions of the build.
So with that background, to answer your questions:
ouruser/sinatra is located on your local Docker host until you do a docker push
No, the repository and the tag is the name of the image.
While local on your system, you can use this image locally. Once you push it up to a registry, you can then pull it down to any other Docker host that has access to that registry. And if you do a docker save you can save that image for a docker load on another host.
I'm sure there is documentation covering this somewhere on docs.docker.com, but I learned from a class.
The username/imagebase format came about to support pushing to your own namespace in hub.docker.com. Without that, whoever makes the first "Redis" image calls it "redis" while the next person makes their own repository called "redis-improved", and we quickly get into a jumble of confusing names where it's not clear who made what and what is a reputable image. That naming isn't required for images you make locally, but is still encouraged since images you pull from hub.docker.com may lack a username if they are maintained by Docker themselves. Without your username, you won't know which images you pulled down and which you built yourself.

Resources