Cannot push: Bad Credentials

Not specified by the original author.

TL;DR

The denied message means the push reached the registry with no credentials, the wrong credentials, or credentials that lack write rights on that repository. Re-authenticate to the exact registry host in the image tag and confirm the token scope, because registries intentionally give no further detail.

denied: requested access to the resource is denied

Steps

1. Confirm which registry host the image is actually tagged for:

docker image inspect [IMAGE]:[TAG] --format '{{.RepoTags}}'

Expected: a tag list showing the full host path, for example registry.example.com/[TEAM]/[APP]:[TAG]. You must log in to exactly this host.

2. Log in to that host using stdin so the credential never lands in shell history:

echo "[YOUR PASSWORD OR TOKEN VALUE]" | docker login [REGISTRY_HOST] -u [USERNAME] --password-stdin

Expected: Login Succeeded.

3. Rule out a stale credential entry by logging out and back in:

docker logout [REGISTRY_HOST]
docker login [REGISTRY_HOST] -u [USERNAME] --password-stdin

Expected: a fresh Login Succeeded, proving you are not running on a cached entry from a previous rotation.

4. In CI, verify the credential helper actually has an entry for the host:

echo "[REGISTRY_HOST]" | docker-credential-[HELPER] get

Expected: output naming the ServerURL, Username, and a Secret value for the host. If it returns nothing, the helper has no entry and the push went anonymous.

5. Push and watch for whether the denial repeats with fresh credentials:

docker push [REGISTRY_HOST]/[TEAM]/[APP]:[TAG]

Expected: layers upload and a final digest line. If it still denies, the credential is valid but lacks push scope on that repo, so fix the access grant in the registry, not the client.

When to use

• docker push fails with the denied message as soon as the push starts
• A CI job that used to push fine started denying after a credential rotation
• You can pull from the registry but cannot push to it

When not to use

• The failure says unauthorized: authentication required before any push attempt, which is a missing login rather than a denied write
• The push fails with name unknown or a 404, which means the repository name itself is wrong
• The daemon reports DNS or TLS errors, meaning the push never reached the registry

Why it happens

Docker sends whatever credential is stored for the registry host in ~/.docker/config.json or returned by the configured credential helper. A tag host that differs from the login host, a stale token after rotation, or a token scoped pull-only all produce the identical denial, and registries deliberately do not distinguish bad credentials from insufficient scope in this message.

Edge cases

• You logged in to docker.io but tagged the image for a mirror or a registry host with a port; log in to the host as it appears in the tag
• Docker Desktop credential helpers keep an old token after docker login; run docker logout for the host first, then log in again
• Org registries deny when the token was issued for a different org than the repo belongs to
• Tokens minted through an SSO flow can expire independently of the CLI session, so a morning push can fail where yesterday's worked

Provenance

Resolved from the public thread: https://vectle.com/posts/pstELqUImi6-mURwcQfTqBzw

Resolved from the public thread: https://vectle.com/posts/pstELqUImi6-mURwcQfTqBzw

Thread query: "docker push" "denied: requested access to the resource is denied": registry auth fix

TL;DR: The denied message means the push reached the registry with no credentials, the wrong credentials, or credentials that lack write rights on that repository. Re-authenticate to the exact registry host in the image tag and confirm the token scope, because registries intentionally give no further detail.

Not specified by the original author.

TL;DR

Use [skip ci] in the automated commit message to avoid triggering another pipeline run in a loop.

Steps

1. Grant the build service identity Contribute permission on the repository: Project Settings, Repositories, pick the repo, Permissions, and allow Contribute for the [Project] Build Service user. Also make sure the checkout step persists credentials (persistCredentials: true) so git inside the pipeline can authenticate. Use [skip ci] in the automated commit message to avoid triggering another pipeline run in a loop.
2. - Also make sure the checkout step persists credentials (persistCredentials: true) so git inside the pipeline can authenticate.

When to use

You are seeing this: Grant the build service identity Contribute permission on the repository: Project Settings, Repositories, pick the repo, Permissions, and allow Contribute for the [Project] Build Service user. Use this skill when you run into "Azure Pipelines: git push from a pipeline needs Contribute permission".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

Edge cases

• Also make sure the checkout step persists credentials (persistCredentials: true) so git inside the pipeline can authenticate.

Source: Stack Overflow #56541458 (accepted answer, 88 votes): a pipeline commits a version bump and tries git push, which fails with a GenericContribute permission error. The pipeline runs as the Project Collection Build Service identity, not as the user who queued it, and that identity has no write access to the repo by default.

Verified resolution: Grant the build service identity Contribute permission on the repository: Project Settings, Repositories, pick the repo, Permissions, and allow Contribute for the [Project] Build Service user. Also make sure the checkout step persists credentials (persistCredentials: true) so git inside the pipeline can authenticate. Use [skip ci] in the automated commit message to avoid triggering another pipeline run in a loop.

Source URL: https://stackoverflow.com/questions/56541458/azure-pipeline-doest-allow-to-git-push-throwing-genericcontribute-permission

Not specified by the original author.

TL;DR

Docker's "manifest unknown" on push means the registry does not recognize the repository name or the tag you are pushing to, usually because the image is not tagged with the full registry path or you lack permission to create that repository. Retag the image with the complete [registry]/[repo]:[tag] name, confirm you are logged in, then push again.

Error / query

"manifest unknown" Docker push error fix

Use this skill when

• docker push fails with manifest unknown: manifest unknown or name unknown
• The push fails right after a successful docker build
• Pushing to a new repository name in the registry for the first time
• CI pushes fail while local pushes to the same registry work

Not for this skill when

• docker pull fails with manifest unknown (the image genuinely does not exist remotely; check the tag)
• The error is unauthorized or denied (auth problem, different fix)
• The push fails mid-upload with network errors (connectivity, not naming)
• You are debugging registry storage or garbage collection (server-side, not the push command)

Steps

Step 1: Inspect how the image is currently tagged

docker images | grep -i [image-name]

Expected: the REPOSITORY column shows the full name. If it is just [image] with no registry host, the push is going to the wrong place (default Docker Hub) and the registry answers "manifest unknown".

Step 2: Retag with the full registry path

docker tag [image]:[tag] [registry-host]/[repo]/[image]:[tag]
docker images | grep [registry-host]

Expected: the new tag appears with the complete path. Every segment (host, namespace/repo, tag) must match what the registry expects.

Step 3: Confirm you are logged in to that registry

docker login [registry-host]

Expected: Login Succeeded. An expired or missing login can surface as manifest/name errors on registries that hide "repository not found" behind auth.

Step 4: Push the fully qualified tag

docker push [registry-host]/[repo]/[image]:[tag]

Expected: layer upload progress ending in [tag]: digest: sha256:... size: .... That digest line is the success signal.

Step 5: Verify the manifest exists in the registry

docker buildx imagetools inspect [registry-host]/[repo]/[image]:[tag] | head -20

Expected: manifest details print without errors. If this fails after a successful push, suspect registry replication lag or a read/write permission split.

Variant phrasings

"docker push name unknown repository does not exist"

The repo path is wrong or your credentials cannot see it. Steps 2-3 cover both.

"manifest unknown pushing to ECR/GCR/ACR"

Cloud registries need the exact repository URI format and the repo may need to exist first (ECR does not auto-create by default). Create the repository, then push.

"denied: requested access to the resource is denied on push"

Auth or permission, not naming. Check the login identity has push rights to that repository.

Why it happens

docker push addresses the registry purely by the tag string. A short tag like myapp:latest resolves against the default registry and library namespace, so pushing to a private registry without the full path targets a repository that does not exist there. Registries answer unknown repositories with "manifest unknown" or "name unknown" rather than a friendlier message.

Edge cases and pitfalls

• Multi-arch images pushed per-arch without a manifest list show manifest unknown on pull of the combined tag; push with docker buildx --push to create the list.
• Some registries are case-sensitive and reject uppercase in repository names; keep names lowercase.
• CI credential helpers can silently use stale tokens; re-login in the pipeline if pushes worked before and stopped.
• Pushing to a tag that a retention policy just garbage-collected can behave oddly; check registry retention rules.
• A proxy or mirror in front of the registry can return manifest unknown for uncached paths; push directly to the registry host to test.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_K-qA8wrJvzsAXnh02WAGlg

Resolved from the public thread: https://vectle.com/posts/pst_K-qA8wrJvzsAXnh02WAGlg

Thread query: "manifest unknown" Docker push error fix

TL;DR: Docker's "manifest unknown" on push means the registry does not recognize the repository name or the tag you are pushing to, usually because the image is not tagged with the full registry path or you lack permission to create that repository. Retag the image with the complete [registry]/[repo]:[tag] name, confirm you are logged in, then push again.