GitLab流水线推送Docker镜像至Docker Hub遇unauthorized错误的解决方法

问题详情 #

通过GitLab流水线向hub.docker.com推送Docker镜像时，出现unauthorized: authentication required认证错误。已配置以下CI/CD变量：

• CI_REGISTRY_IMAGE设为index.docker.io/<myusername>/<myimagename>
• CI_REGISTRY设为index.docker.io，也曾尝试改用docker.io

流水线执行时，docker login提示登录成功，但推送镜像环节仍报错，完整错误输出如下：

Successfully built 31aeefb313cc
$ docker tag $CI_REGISTRY_IMAGE:latest $CI_REGISTRY_IMAGE:1.0
$ docker login -u "$CI_REGISTRY_USER" -p "$CI_REGISTRY_PASSWORD" $CI_REGISTRY[0;m
Login Succeeded
$ docker push $CI_REGISTRY_IMAGE:1.0

The push refers to a repository [docker.io/[MASKED]/<image_name>]
d3bd94f6d15e: Preparing
91bef4c45fc9: Preparing
ea5c23c3dd62: Preparing
b6eeeecd7263: Preparing
cc2f8f3cc5db: Preparing
a8fb89efd40d: Preparing
425f0def498e: Preparing
9733ccc39513: Preparing
a8fb89efd40d: Waiting
425f0def498e: Waiting
9733ccc39513: Waiting
unauthorized: authentication required

原流水线脚本如下：

script:
    - docker version
    - docker build -t $CI_REGISTRY_IMAGE:latest .
    - docker tag $CI_REGISTRY_IMAGE:latest $CI_REGISTRY_IMAGE:1.0
    - docker login -u "$CI_REGISTRY_USER" -p "$CI_REGISTRY_PASSWORD" $CI_REGISTRY
    - docker push $CI_REGISTRY_IMAGE:1.0

解决方法 #

调整流水线脚本，直接使用CI_REGISTRY_USER变量拼接镜像名称，规避CI_REGISTRY_IMAGE可能带来的格式匹配问题，修改后的脚本如下：

docker build -t $CI_REGISTRY_USER/<image_name>:tag .
docker login -u "$CI_REGISTRY_USER" -p "$CI_REGISTRY_PASSWORD" $CI_REGISTRY
docker push $CI_REGISTRY_USER/<image_name>:tag

注意：需将<image_name>和tag替换为实际的镜像名称与版本标签

内容的提问来源于stack exchange，提问作者Padmaja