Your browser does not seem to support JavaScript. As a result, your viewing experience will be diminished, and you may not be able to execute some actions.

Please download a browser that supports JavaScript, or enable it if it's disabled (i.e. NoScript).

GitLab Container Registry: errors: denied: requested access to the resource is denied [...] error parsing HTTP 401 response body

magpie QA Engineer

When I run podman push (the equiv of docker push) to get my image up to GitLab's container registry, I'm getting the following error.

errors: denied: requested access to the resource is denied [...] error parsing HTTP 401 response body: unexpected end of JSON input: ""

You can see it all here,

❯ podman push localhost/acme-web-release registry.gitlab.com/evancarroll/acme-backend
Getting image source signatures
Error: trying to reuse blob sha256:1e05dc5a6784f6e7375fe1f73dc2b02f7d184bc53a0150daf06062dcbfde02d4 at destination: checking whether a blob sha256:1e05dc5a6784f6e7375fe1f73dc2b02f7d184bc53a0150daf06062dcbfde02d4 exists in registry.gitlab.com/evancarroll/acme-backend: errors:
denied: requested access to the resource is denied
error parsing HTTP 401 response body: unexpected end of JSON input: ""

I've confirmed that I've podman login (the podman analog of docker login) with a Personal Access Token that grants write_registry).

carriann last edited by

A personal access token to push to the registry does not just require write_registry but ALSO read_registry or read_api (more general).
Reply Quote 0
1 Reply Last reply

2
Posts

0
Views

Suggested Topics

Y

Ansible playbook error: Collection' object is not callable
Continuous Integration and Delivery (CI, CD) • mongodb ansible • • yajahira

2

0
Votes

2
Posts

0
Views

K

Note: this answer will very likely and quickly become obsolete when a new version of the https://github.com/ansible-collections/community.mongodb is released The current version (i.e. v1.3.2 at time of this writing) is not compatible with the python module pymongo version 4.x. You need to downgrade the library to version 3.x until the collection is fixed. The current https://github.com/ansible-collections/community.mongodb/commit/26c77072ff10a2a396ee309928d052c142811c7a on the collection master branch is actually fixing the library version to v3.12.2 but has not yet been relased. Hopefully this will soon make it into a patch version for the collection. In the mean time, it seems that the developers have already started https://github.com/ansible-collections/community.mongodb/tree/pymongo4 . There is also https://github.com/ansible-collections/community.mongodb/issues/424 related to this problem.
D

Set container registry auth key via command line/env variable
Continuous Integration and Delivery (CI, CD) • docker registry • • Duquan

2

0
Votes

2
Posts

1
Views

You mentioned that the auth key is stored in Jenkins credentials and are available as environment variables, if so, then your half task is already done; what you can probably do from here is, use those environment variables to perform docker login (assuming USERNAME and PASSWORD are the Jenkins credentials variable), use the below command to login docker login your.docker-registry.com -u $USERNAME -p $PASSWORD This assumes, that your registry has SSL enabled, if so, don't forget to place the registry certificates under the below name on your Jenkin host /etc/docker/certs.d/your.docker-registry/ca.crt Post this, you would be able to push image to the registry
T

How to make an AWS S3 bucket accessible over HTTP?
Continuous Integration and Delivery (CI, CD) • http amazon web services amazon s3 • • Trenton

2

0
Votes

2
Posts

1
Views

B

Download - yes. Simply set each Object ACL to be publicly readable. List - sort of. If you set the Bucket ACL to publicly readable anyone can list the content. However it's a rather human-unfriendly XML listing. You can generate your directory listings to some index.html files through an external process and configure the bucket to serve those. Basic auth - nope. You can look at something like S3 pre-signed URLs to protect the content. Hope that helps
C

Why does stripping executables in Docker add ridiculous layer memory overhead?
Continuous Integration and Delivery (CI, CD) • linux docker containers • • chanisef

2

0
Votes

2
Posts

0
Views

A

Each directive in your Dockerfile adds another layer to the image. So anything you do -- removing files, stripping binaries, etc -- is only going to increase the size of the image. It looks like you're trying to overcome this issue by using a multi-stage build, but that's not doing you any good: those two COPY directives are introducing effectively the same changes introduced by the find command in the previous stage. The way to solve this is by discarding the old layers, generally by creating a new image that reflects the state of the top layer only. This is called "squashing" the image, and there are various ways of doing this. Here's one mechanism that works. For this example, I'm using this Dockerfile (based on your linked example) to build squashtest:base: FROM docker.io/parrotsec/core:base-lts-amd64 RUN export DEBIAN_FRONTEND=noninteractive && apt-get -q -y update --no-allow-insecure-repositories && apt-get -y upgrade --with-new-pkgs && apt-get -y install --no-install-recommends aria2=1.35.0-3 apparmor=2.13.6-10 apparmor-utils=2.13.6-10 auditd=1:3.0-2 curl debsums=3.0.2 gawk=1:5.1.0-1 git iprange=1.0.4+ds-2 jq=1.6-2.1 libdata-validate-domain-perl=0.10-1.1 libdata-validate-ip-perl=0.30-1 libnet-idn-encode-perl=2.500-1+b2 libnet-libidn-perl=0.12.ds-3+b3 libregexp-common-perl=2017060201-1 libtext-trim-perl=1.04-1 libtry-tiny-perl=0.30-1 localepurge=0.7.3.10 locales miller=5.10.0-1 moreutils=0.65-1 p7zip-full=16.02+dfsg-8 pandoc=2.9.2.1-1+b1 preload=0.6.4-5+b1 python3-pip=20.3.4-4+deb11u1 rkhunter=1.4.6-9 symlinks=1.4-4 && apt-get install -y --no-install-recommends --reinstall ca-certificates=* && apt-get -y autoremove && apt-get -y clean && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/* && rm -f /var/cache/ldconfig/aux-cache && find -P -O3 /var/log -depth -type f -print0 | xargs -0 truncate -s 0 && localedef -i en_US -c -f UTF-8 -A /usr/share/locale/locale.alias en_US.UTF-8 && localepurge && symlinks -rd / && apt-get -y purge --auto-remove localepurge symlinks && find -P -O3 /etc/ /usr/ -type d -empty -delete Build the base image. docker build -t squashtest:base -f Dockerfile.base . This produces the following: $ docker image ls squashtest:base REPOSITORY TAG IMAGE ID CREATED SIZE squashtest base 58dff2c40a28 About an hour ago 786MB Build a new image squashtest:stripped with stripped binaries using this Dockerfile: FROM squashtest:base RUN find -P -O3 /usr/bin/ /usr/local/bin -type f -not -name strip -and -not -name dbus-daemon -execdir strip -v --strip-unneeded '{}' ; || : Which produces: $ docker image ls squashtest:stripped REPOSITORY TAG IMAGE ID CREATED SIZE squashtest stripped 42aa25ebc0c7 About an hour ago 997MB At this point, the image consists of the following layers: $ docker image inspect squashtest:stripped | jq '.[0].RootFS' { "Type": "layers", "Layers": [ "sha256:7e203d602b1c20e9cf0b06b3dd3383eb36bc2b25f6e8064d9c81326dfdc67143", "sha256:1fc5866a0b6b7a23a246acfd46b4c513b4a188d2db2d8a26191989a4a18c74d3", "sha256:cc3a9d1a7f9222eee31b688d887c79745e20389ecfe0fe208349c73cfd172b4a" ] } We can collapse these into a single layer like this: docker run --rm squashtest:stripped \ tar -C / -cf- --exclude=./dev --exclude=./sys \ --exclude=./proc . | docker import - squashtest:imported This produces: $ docker image ls squashtest:imported REPOSITORY TAG IMAGE ID CREATED SIZE squashtest imported 6f036f16d477 46 seconds ago 626MB We've saved 160MB off the base image. There are other ways to squash a Docker image; there are a number of tools on GitHub ( https://github.com/goldmann/docker-squash , https://github.com/jwilder/docker-squash , https://github.com/qwertycody/Bash_Docker_Squash ) that accomplish something similar. docker build https://docs.docker.com/engine/reference/commandline/build/ if you enable experimental features, but that doesn't appear to accomplish much when I try it. I would argue that for the 160MB we've managed to save here the effort isn't worth it. Unless you're running Docker in an extremely constrained environment, that's going to be nothing but a drop in the bucket (for reference, that's about the size of /bin/ls). In fact, the strip operation in your Dockerfile is mostly pointless: distributions generally strip binaries by default; you can verify this by running file on all the binaries in /usr/bin and /bin on docker.io/parrotsec/core:base-lts-amd64: $ docker run -it --rm docker.io/parrotsec/core:base-lts-amd64 bash # apt -y install file # file /bin/* /usr/bin/* | grep ELF | grep -v stripped That last command returns zero results: all the binaries have been stripped.
O

Minikube - Is there a way to run Windows Containers?
Continuous Integration and Delivery (CI, CD) • windows containers minikube • • obi

2

0
Votes

2
Posts

1
Views

O

It is not officially supported (as of Minikube 0.25.0, Kubernetes 1.9, January 2018). But there is Beta support for Windows server containers in Kubernetes. These articles contain more information: http://blog.kubernetes.io/2018/01/kubernetes-v19-beta-windows-support.html https://kubernetes.io/docs/getting-started-guides/windows
N

Is it necessary to specify resource in S3 Bucket Policies?
Continuous Integration and Delivery (CI, CD) • amazon web services amazon s3 • • Nykeriab

2

0
Votes

2
Posts

1
Views

M

Yes, Resource is a required element on S3 bucket policies. If the resource is omitted, the API will respond with an error resembling this one below. status code: 400 Error putting S3 policy: MalformedPolicy: Statement is missing required element The reasoning is that each statement could apply to the bucket itself, the contents of the bucket, or some subset of the bucket contents, and it's up to the user to clarify. In theory AWS could provide a default that includes both the bucket and all of its contents, but that design probably wasn't chosen because it makes it too easy to accidentally make the bucket policies broader than expected. Additionally, it is not permissible to use a wildcard in the resource element of an S3 bucket policy. Attempts to do so will yield an error such as this: Error putting S3 policy: MalformedPolicy: Policy has invalid resource
J

AWS API Gateway as an http proxy to ALB
Continuous Integration and Delivery (CI, CD) • api amazon web services amazon ec2 load balance aws elb • • jonetta

2

0
Votes

2
Posts

1
Views

B

Try directly accessing https://my-api-lb-111222333.us-east-1.elb.amazonaws.com from your web browser and you'll get a similar error. The SSL certificate is not just used for encryption -- it also verifies that the host is not an impostor, by being consulted in a check of whether the hostname used to access the target matches the hostname of the certificate that's offered by the target Because amazonaws.com is not your domain, you can't get a certificate for that. You need to assign a domain name from your domain to the ALB in DNS, e.g. origin.example.com, and point API Gateway to that name, not to the system-assigned hostname of the ALB.
Privilege escalation writing /etc/passwd but without SUID permission on su
Security, Penetration Testing • linux permissions docker capabilities • • Demir

2

0
Votes

2
Posts

1
Views

On a standard Linux host (VM or server) if you have access to /etc/passwd or /etc/shadow then you can modify or add credentials to accounts, which would obviously be a serious problem (there's details on the consequences of allowing a modification to /etc/passwd in this answer In a Docker container, usually the software which makes use of these files is not installed, so no Linux PAM, no SSHD, or other software which would make use of an authentication database. Without that type of software being installed, there's not much you can do, as there are no programs which operate on those files. Of course, if the application running in the container makes use of /etc/passwd then modifying it could have an impact, but that'll be situational depending on what the container does.
J

How to create a second IP just for dockers
Continuous Integration and Delivery (CI, CD) • docker networking • • jules

2

0
Votes

2
Posts

1
Views

A

If you pass the listen address as the very first component of -p, Docker will only listen on that address: $ docker run -p 127.0.1.2:8080:80 -d nginx` $ ss -ltp | grep 127.0.1.2 LISTEN 0 4096 127.0.1.2:http-alt 0.0.0.0:*
A

Are using TestContainers safe for integration tests?
Continuous Integration and Delivery (CI, CD) • security docker continuous integration microservices integration • • Anderson

2

0
Votes

2
Posts

1
Views

M

I think the question about Docker security in general was already well answered in other places, for example here: https://stackoverflow.com/questions/40844197/what-is-the-docker-security-risk-of-var-run-docker-sock In your particular instance, I see the following points: The tests should run on some testing server, possibly even in a VM that is destroyed/reset after each test run, so possible accidents/incidents should not affect other systems For an attacker to use this setup, they would probably (depending on your tests) need to be able to modify your test code and if they are able to do so, you will already have much bigger problems than privileged Docker access
O

What is an example of an error that tflint will catch that `terraform init` will not error on?
Continuous Integration and Delivery (CI, CD) • terraform • • Oba22

2

0
Votes

2
Posts

0
Views

A

These are the default https://github.com/terraform-linters/tflint-ruleset-terraform/blob/main/docs/rules/README.md for tflint. Most of these rules will have an example of how to trigger it and remediate it. A simple one you could use is the terraform_comment_syntax https://github.com/terraform-linters/tflint-ruleset-terraform/blob/main/docs/rules/terraform_comment_syntax.md . You can trigger it by using a // comment inside a *.tf file.
A

How to run a gitlab child pipeline only on changes in merge requests?
Continuous Integration and Delivery (CI, CD) • gitlab gitlab ci runner • • authera

2

0
Votes

2
Posts

0
Views

Why are you using the same rules for both parent and child pipelines? You are just triggering the child service if anything changes on files inside the child service directory So, just define rules on child pipeline... It will automatically trigger if any changes happen on service_a/*
Docker swarm join linux container Error - remote CA does not match fingerprint
Continuous Integration and Delivery (CI, CD) • docker containers docker swarm • • jeanid

2

0
Votes

2
Posts

1
Views

G

If you configured and joined correctly you should see two hosts: one for Linux and one for Windows. Windows hosts cannot natively run inside the Linux hosts and vice-versa. This means you have to have different kernels for Linux hosts and Windows hosts in the same swarm. This way they can communicate across the same Docker network. Refer to Docker Engine on Windows for more info.
G

Spring gateway mapping to spring rest data
Software Programming • java docker spring boot docker compose microservices • • guilherme

2

0
Votes

2
Posts

0
Views

A

I found this option in HATEOAS Services, we need to include X-FORWARD-* headers. Add a filter.@Bean FilterRegistrationBean<ForwardedHeaderFilter> forwardedHeaderFilter() { FilterRegistrationBean<ForwardedHeaderFilter> bean = new FilterRegistrationBean<>(); bean.setFilter(new ForwardedHeaderFilter()); return bean; }
"error: src refspec TstBranch does not match any."
Software Programming • git github gitlab • • Laycee

2

0
Votes

2
Posts

0
Views

K

Judging by your screams, and according to you, you always work in a branch. master, you had to create a new branch (what you did), go to it through. git For example, this is done:git checkout -b TstBranch And then when you're on this branch, you've been making changes and licking them, and that's how you've been trying to pour it all the time. master I think it's another branch.So that this doesn't happen again, check the current branch with the team:git status Move between the branches of the team:git checkout name

GitLab Container Registry: errors: denied: requested access to the resource is denied [...] error parsing HTTP 401 response body

Suggested Topics

Ansible playbook error: Collection' object is not callable Continuous Integration and Delivery (CI, CD) • mongodb ansible • • yajahira

Set container registry auth key via command line/env variable Continuous Integration and Delivery (CI, CD) • docker registry • • Duquan

How to make an AWS S3 bucket accessible over HTTP? Continuous Integration and Delivery (CI, CD) • http amazon web services amazon s3 • • Trenton

Why does stripping executables in Docker add ridiculous layer memory overhead? Continuous Integration and Delivery (CI, CD) • linux docker containers • • chanisef

Minikube - Is there a way to run Windows Containers? Continuous Integration and Delivery (CI, CD) • windows containers minikube • • obi

Is it necessary to specify resource in S3 Bucket Policies? Continuous Integration and Delivery (CI, CD) • amazon web services amazon s3 • • Nykeriab

AWS API Gateway as an http proxy to ALB Continuous Integration and Delivery (CI, CD) • api amazon web services amazon ec2 load balance aws elb • • jonetta

Privilege escalation writing /etc/passwd but without SUID permission on su Security, Penetration Testing • linux permissions docker capabilities • • Demir

How to create a second IP just for dockers Continuous Integration and Delivery (CI, CD) • docker networking • • jules

Are using TestContainers safe for integration tests? Continuous Integration and Delivery (CI, CD) • security docker continuous integration microservices integration • • Anderson

What is an example of an error that tflint will catch that `terraform init` will not error on? Continuous Integration and Delivery (CI, CD) • terraform • • Oba22

How to run a gitlab child pipeline only on changes in merge requests? Continuous Integration and Delivery (CI, CD) • gitlab gitlab ci runner • • authera

Docker swarm join linux container Error - remote CA does not match fingerprint Continuous Integration and Delivery (CI, CD) • docker containers docker swarm • • jeanid

Spring gateway mapping to spring rest data Software Programming • java docker spring boot docker compose microservices • • guilherme

"error: src refspec TstBranch does not match any." Software Programming • git github gitlab • • Laycee

Ansible playbook error: Collection' object is not callable
Continuous Integration and Delivery (CI, CD) • mongodb ansible • • yajahira

Set container registry auth key via command line/env variable
Continuous Integration and Delivery (CI, CD) • docker registry • • Duquan

How to make an AWS S3 bucket accessible over HTTP?
Continuous Integration and Delivery (CI, CD) • http amazon web services amazon s3 • • Trenton

Why does stripping executables in Docker add ridiculous layer memory overhead?
Continuous Integration and Delivery (CI, CD) • linux docker containers • • chanisef

Minikube - Is there a way to run Windows Containers?
Continuous Integration and Delivery (CI, CD) • windows containers minikube • • obi

Is it necessary to specify resource in S3 Bucket Policies?
Continuous Integration and Delivery (CI, CD) • amazon web services amazon s3 • • Nykeriab

AWS API Gateway as an http proxy to ALB
Continuous Integration and Delivery (CI, CD) • api amazon web services amazon ec2 load balance aws elb • • jonetta

Privilege escalation writing /etc/passwd but without SUID permission on su
Security, Penetration Testing • linux permissions docker capabilities • • Demir

How to create a second IP just for dockers
Continuous Integration and Delivery (CI, CD) • docker networking • • jules

Are using TestContainers safe for integration tests?
Continuous Integration and Delivery (CI, CD) • security docker continuous integration microservices integration • • Anderson

What is an example of an error that tflint will catch that `terraform init` will not error on?
Continuous Integration and Delivery (CI, CD) • terraform • • Oba22

How to run a gitlab child pipeline only on changes in merge requests?
Continuous Integration and Delivery (CI, CD) • gitlab gitlab ci runner • • authera

Docker swarm join linux container Error - remote CA does not match fingerprint
Continuous Integration and Delivery (CI, CD) • docker containers docker swarm • • jeanid

Spring gateway mapping to spring rest data
Software Programming • java docker spring boot docker compose microservices • • guilherme

"error: src refspec TstBranch does not match any."
Software Programming • git github gitlab • • Laycee