On stack deploy, unable to pin image to digest: unauthorized: the client does not have permission for manifest

Question

I'm running a Docker stack using a custom image which I have pushed to an Artifactory repository.

docker-compose.yml:

version: "3"

services:
  app:
    image: repo.example.com/my_image:latest

I can pull the image fine, and I can deploy the stack fine, but if I try to redeploy the stack, I get an error.

$ docker stack deploy --with-registry-auth -c docker-compose.yml my_stack
Creating network my_stack_default
Creating service my_stack_app

$ docker stack deploy --with-registry-auth -c docker-compose.yml my_stack
Updating service my_stack_app (id: 8po6oepjdgo8kwsb7n4ig64dt)
unable to pin image repo.example.com/my_image:latest to digest: unauthorized: The client does not have permission for manifest

I expect Docker to update the image when I redeploy the stack, just like it would if I used an image from Docker Hub.

I've seen Docker say unable to pin image before, but that was when I did not specify a repository (e.g. docker.io). I know I have permission from repo.example.com because I pushed the image there, I can still pull from it, and I can start the stack. I just can't update it.

What does this client does not have permission for manifest error mean, and how do I fix this issue?

Answer 1

If you have all of your permissions approved then the issue may be that your local .docker\config.json file has not been created.

If that is the case then you may want to run this command in the terminal at the root of your folder:

docker login repo.example.com

That will take your credentials and store them in an unencrypted .docker\config.json file.

After that your deploy should work (and you might want to consider configuring a credential helper to keep your credentials safe).

Answer 2

The issue was we were using a specific old version of Docker Swarm (I think version 13) that had a bug that caused this error. We were limited to that version since RHEL7 at the time was limited to that version. Using Ubuntu and updating Docker to a more recent version solved it.