GitHub Action部署阶段拉取Docker Hub镜像失败求助

我尝试用AWS EC2实例部署Node应用，通过Docker Hub配合GitHub Action实现CI/CD：已创建Docker Hub免费版仓库，编写了.github/workflows/cicd.yml文件，Build阶段能成功登录Docker Hub并推送镜像到仓库，但Deploy阶段（运行在自托管runner）执行docker pull拉取镜像时，出现权限拒绝错误，提示仓库不存在或需登录。尝试指定latest标签、更换为docker/login-action@v3登录、重新生成Docker Hub访问令牌后，问题仍未解决。

相关配置文件及错误信息 #

CI/CD配置文件 #

name: Deploy Node Application

on: 
  push:
    branches:
      - mern-ec2-docker

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout Source
        uses: actions/checkout@v4
      - name: Login to docker hub
        run: docker login -u ${{ secrets.DOCKER_USERNAME }} -p ${{ secrets.DOCKERHUB_TOKEN }}
      - name: Build Docker Image
        run: docker build -t ziendocker/zien-backend  .
      - name: Publish Image to docker hub
        run: docker push ziendocker/zien-backend:latest 
 
  deploy:
    needs: build
    runs-on: self-hosted 
    steps:
      - name: Pull image from docker hub
        run: docker pull ziendocker/zien-backend 
      - name: Delete old container
        run: docker rm -f nodejs-app-container  
      - name: Run Docker Container
        run: docker run -d -p 4000:4000 --name nodejs-app-container -e MONGO_PASSWORD='${{ secrets.MONGO_PASSWORD }}' ziendocker/zien-backend

Dockerfile #

FROM node:alpine3.18
WORKDIR /app
COPY package.json ./
RUN npm install
COPY . .
EXPOSE 5000
CMD [ "npm","run","start"]

拉取镜像错误信息 #

Run docker pull ziendocker/zien-backend
docker pull ziendocker/zien-backend
shell: /usr/bin/bash -e {0}
Using default tag: latest
Error response from daemon: pull access denied for ziendocker/zien-backend, repository does not exist or may require 'docker login': denied: requested access to the resource is denied
Error: Process completed with exit code 1.

更换登录方式后的错误 #

Run docker/login-action@v3
  with:
    password: ***
    ecr: auto
    logout: true
Error: Username and password required

核心问题分析 #

• Deploy阶段的自托管runner是独立环境，Build阶段的Docker登录状态不会共享，导致拉取私有镜像时无权限
• 使用docker/login-action@v3时未指定必填的username参数，引发登录失败

具体修复步骤 #

1. 在Deploy阶段添加Docker Hub登录步骤
   自托管runner必须单独完成登录操作，两种可选方式：

   • 方式一：用原生docker login命令
     在Deploy的steps中添加：

     - name: 登录Docker Hub
       run: docker login -u ${{ secrets.DOCKER_USERNAME }} -p ${{ secrets.DOCKERHUB_TOKEN }}
     

   • 方式二：正确配置docker/login-action@v3
     必须补充username参数：

     - name: 登录Docker Hub
       uses: docker/login-action@v3
       with:
         username: ${{ secrets.DOCKER_USERNAME }}
         password: ${{ secrets.DOCKERHUB_TOKEN }}
     

2. 确保自托管runner的Docker权限
   运行runner的用户需要有Docker执行权限，执行以下命令添加权限（执行后需重启runner或重新登录）：

   sudo usermod -aG docker $USER
   

3. 统一镜像标签
   Build阶段推送的是latest标签，Deploy阶段拉取时明确指定标签，避免默认匹配异常：

   - name: 拉取Docker镜像
     run: docker pull ziendocker/zien-backend:latest
   

4. 验证仓库与令牌权限
   检查Docker Hub仓库名称拼写是否与推送时一致，同时确认访问令牌拥有该仓库的拉取权限。

修正后的完整Deploy任务示例 #

deploy:
  needs: build
  runs-on: self-hosted 
  steps:
    - name: 登录Docker Hub
      uses: docker/login-action@v3
      with:
        username: ${{ secrets.DOCKER_USERNAME }}
        password: ${{ secrets.DOCKERHUB_TOKEN }}
    - name: 拉取Docker镜像
      run: docker pull ziendocker/zien-backend:latest
    - name: 删除旧容器
      run: docker rm -f nodejs-app-container || true
    - name: 启动新容器
      run: docker run -d -p 4000:4000 --name nodejs-app-container -e MONGO_PASSWORD='${{ secrets.MONGO_PASSWORD }}' ziendocker/zien-backend:latest

（注：删除容器命令添加|| true，避免容器不存在时任务直接失败）

内容的提问来源于stack exchange，提问作者amalu