On stack deploy, unable to pin image to digest: unauthorized: the client does not have permission for manifest

Question

I'm running a Docker stack using a custom image which I have pushed to an Artifactory repository.

docker-compose.yml:

version: "3"

services:
  app:
    image: repo.example.com/my_image:latest

I can pull the image fine, and I can deploy the stack fine, but if I try to redeploy the stack, I get an error.

$ docker stack deploy --with-registry-auth -c docker-compose.yml my_stack
Creating network my_stack_default
Creating service my_stack_app

$ docker stack deploy --with-registry-auth -c docker-compose.yml my_stack
Updating service my_stack_app (id: 8po6oepjdgo8kwsb7n4ig64dt)
unable to pin image repo.example.com/my_image:latest to digest: unauthorized: The client does not have permission for manifest

I expect Docker to update the image when I redeploy the stack, just like it would if I used an image from Docker Hub.

I've seen Docker say unable to pin image before, but that was when I did not specify a repository (e.g. docker.io). I know I have permission from repo.example.com because I pushed the image there, I can still pull from it, and I can start the stack. I just can't update it.

What does this client does not have permission for manifest error mean, and how do I fix this issue?

Answer 1

This looks like your user does not have the "Delete / Overwrite" permission to this repository. Please ask your Artifactory admin to add this permission to your user for this repository and try again.

Hope this helps!

Answer 2

If you have all of your permissions approved then the issue may be that your local .docker\config.json file has not been created.

If that is the case then you may want to run this command in the terminal at the root of your folder:

docker login repo.example.com

That will take your credentials and store them in an unecrypted .docker\config.json file.

After that your deploy should work (and you might want to consider configuring a credential helper to keep your credentials safe)