This topic answers common questions about errors that occur when running docker login, docker push, and docker pull with Alibaba Cloud Container Registry.
Docker login errors
Why does docker login fail?
The most common cause is using your Alibaba Cloud account password instead of the registry secret. These are two different credentials. To set a registry secret:
-
Log on to the Container Registry console.
-
On the Instances page, click the instance card to open the instance details page.
-
In the left navigation pane, choose Instances > Access Credential.
-
On the Access Credential page, click Set Password in the upper-right corner.
-
In the Set Password dialog box, enter a secret and click Confirm.
Running `sudo docker login`
When you run sudo docker login, the first password prompt is for your Linux user account, not the registry secret. If the system shows "try again" and allows up to three attempts, it is asking for your Linux password. If the Docker client exits with the following error, it is asking for the registry secret:
Error response from daemon: Get https://registry.cn-hangzhou.aliyuncs.com/v2/: unauthorized: authentication requiredUsing a Resource Access Management (RAM) user
If your account is a Resource Access Management (RAM) user, log on to the Container Registry console as the RAM user, set a separate registry secret, and use that secret to log on. For details, see Configure access credentials for a Container Registry Enterprise Edition instance.
Why does docker login time out?
Check your network connection. If the network is unavailable, the Docker client cannot reach the Container Registry instance and the command times out.
Docker pull errors
Why does docker pull fail with Error: image xxx not found?
Check the following in order:
Image URL
Verify the image URL and tag are correct — this is the most common cause, especially when pulling public images. View the correct URL and tag in the Container Registry console.
Logon status (private repositories only)
Run the following command to see which registries your Docker client is logged on to:
cat ~/.docker/config.jsonIf the registry domain name is missing from the output, run docker login to log on to that registry.
Account permissions
Make sure the account has permission to pull from the repository. RAM users have no permissions by default — grant pull access through repository access control. For details, see Repository access control.
In rare cases, the pull fails with Error: filesystem layer verification failed for digest. This means one or more image layers failed integrity verification — retry the pull to resolve it.
Why can't I pull images as an anonymous user?
Anonymous pull is disabled by default. To enable it, go to the Overview page of your instance, find the Instance Settings section on the right side, and turn on Pull from Anonymous Users.
Docker push errors
Why does docker push fail with denied: requested access to the resource is denied?
This error means the logon account does not have push permission on the repository. The troubleshooting steps are the same as for docker pull failures — verify the image URL, check logon status, and confirm account permissions. Push requires a higher permission level than pull.
Why does docker push fail?
Make sure the target repository exists before pushing. If it does not exist, either create it manually or enable automatic repository creation in the namespace settings.