Pull access denied for ..., repository does not exist or may require 'docker login'

1

Hi,

I’m trying to run a job on my Docker image, and have the following in my workflow.yaml (among other things):

        environment:
          environment_type: docker-encapsulated
          image: gitlab-registry.cern.ch/atlas-phys/exot/ueh/multichargedparticles/2015-2018/analysiscode
          imagetag: latest
          resources:
            - kerberos: true
            - kubernetes_uid: 500

and the job fails with the following in the logs:

Container job failed, error: rpc error: code = Unknown desc = Error response from daemon: pull access denied for gitlab-registry.cern.ch/atlas-phys/exot/ueh/multichargedparticles/2015-2018/analysiscode, repository does not exist or may require 'docker login'krb5: :
 

Completed

I thought this is taken care of by uploading the .keytab file, which I did previously:

(reana) lxplus739 mcps % reana-client secrets-list
NAME          TYPE
.keytab       file
CERN_KEYTAB   env
CERN_USER     env

But obviously I’m missing something - what is it?

2

Hi @ysmirnov, if your GitLab repository is restricted and if the Docker image is not publicly accessible, then you will have to grant REANA access rights to the image. This can be done by granting REANA “reporter” membership rights. Please see our documentation on this: Private Docker registries - Documentation

(Note that the keytab secrets are not really necessary unless your workflow also needs to access some restricted data whilst running.)

3

Thanks, it works now!