Kaniko无法认证Nexus OSS，Docker镜像推送失败（含复现步骤）

使用Kaniko将Docker镜像推送至Nexus OSS 3.49.0-02时出现404错误，访问v2 Docker API的URL格式异常，错误信息如下：

error checking push permissions -- make sure you entered the correct tag name, and that you are authenticated correctly, and try again: checking push permission for "private.registry.com/repository/imagename:tag": creating push check transport for private.registry.com failed: GET https://private.registry.com/v2/: unexpected status code 404 Not Found: ...[html]...

GitLab-CI脚本片段 #

- echo "{\"auths\":{\"private.registry.com\":{\"auth\":\"$NEXUS_DEPLOY_USER_PW_BASE64\"}}}" > /kaniko/.docker/config.json
- /kaniko/executor
      --context "${CI_PROJECT_DIR}/frontend"
      --dockerfile "${CI_PROJECT_DIR}/frontend/Dockerfile.app-builder"
      --build-arg=CI_COMMIT_SHA=$CI_COMMIT_SHA
      --build-arg=CI_COMMIT_BRANCH=$CI_COMMIT_BRANCH
      --build-arg=CI_COMMIT_TAG=$CI_COMMIT_TAG
      --destination "$BASE_URL/app-ui:$APP_VERSION"
      --destination "$BASE_URL/app-ui:$BRANCH_TAG"
      --destination "$BASE_URL/app-ui"

使用非Base64编码的凭证也无法解决该问题，以下是最小化复现步骤：

Dockerfile #

FROM gcr.io/kaniko-project/executor:v1.14.0-debug

ADD Dockerfile.test Dockerfile.test

ARG REGISTRY_URL=[YOUR_NEXUS_URL]/repository/dockercontainer
ARG REGISTRY_USER=[your credential]
ARG REGISTRY_PASSWORD=[your credential]

RUN echo "{\"auths\":{\"$REGISTRY_URL\":{\"username\":\"$REGISTRY_USER\",\"password\":\"$REGISTRY_PASSWORD\"}}}" > /kaniko/.docker/config.json

RUN /kaniko/executor --context "." --dockerfile "Dockerfile.test" --destination "${REGISTRY_URL}/test:latest"

CMD [ "echo", "Hello World" ]

Dockerfile.test #

FROM alpine:latest
CMD [ "echo", "Hello World" ]

目录结构 #

kaniko
  |__ Dockerfile
  |__ Dockerfile.test

执行命令 #

在kaniko目录下执行：

docker build .

内容的提问来源于stack exchange，提问作者KhaosTheory