使用Artifactory 5.9作为Docker Registry遇403禁止访问问题求助

Let’s walk through the most likely causes and fixes for your 403 Forbidden issues when pushing/pulling Docker images to Artifactory. I’ve debugged similar setups before, so let’s start with the highest-impact checks:

1. Verify Artifactory Repository Permissions #

This is the most common culprit. Docker operations require specific permissions depending on whether you’re pushing (deploying) or pulling (reading):

• Local Docker Repository: Ensure your user (or the group they’re in) has both Read and Deploy permissions. Without Deploy, pushes will fail; without Read, pulls won’t work.
• Remote Docker Repository: Users only need Read permission here (since you’re pulling from a remote source, not pushing to it).
• Virtual Docker Repository: Make sure the virtual repo includes your target local/remote repos, and that your user has the appropriate permissions for the virtual repo (matching what’s needed for the underlying repos).

To check:

1. Log into Artifactory’s web UI.
2. Navigate to Admin > Repositories > Repositories.
3. Select your repo, go to the Permissions tab.
4. Confirm your user/group is listed with the correct permissions (check the Actions column for Read/Deploy access).

2. Validate Nginx Reverse Proxy Configuration #

Since you’re using Nginx to proxy Artifactory, a misconfigured location block can easily cause 403 errors. Here’s what to check:

• Ensure your proxy_pass points to the correct Artifactory Docker endpoint: it should follow the pattern http://<artifactory-host>:<artifactory-port>/artifactory/api/docker/<repo-key>/ (don’t forget the trailing slash!).
• Include necessary headers to preserve request context for Artifactory:

  location /docker/<your-repo-key>/ {
      proxy_pass http://localhost:8081/artifactory/api/docker/<your-repo-key>/;
      proxy_set_header Host $host;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto $scheme;
      proxy_send_timeout 1800;
      proxy_read_timeout 1800;
  }
  

• Check Nginx’s error logs (/var/log/nginx/error.log) for hints — look for issues like invalid proxy paths or blocked requests.
• Restart Nginx after making changes: sudo systemctl restart nginx

3. Confirm Docker Insecure Registry Setup is Active #

Even if you added the insecure-registry flag, it’s easy to make a mistake here:

1. Check your Docker daemon config file (/etc/docker/daemon.json) — it should look like this (replace with your Artifactory host/port):

   {
       "insecure-registries": ["your-artifactory-host:80"]
   }
   

2. Restart Docker to apply changes: sudo systemctl restart docker
3. Verify the config is active: run docker info | grep Insecure — you should see your registry listed in the output.

   Note: If your Nginx is listening on a non-standard port (like 8082), make sure to include it in the insecure-registries value.

4. Check Artifactory Request Logs for Detailed Errors #

Artifactory’s logs will tell you exactly why the request is forbidden. Look at $ARTIFACTORY_HOME/logs/artifactory-request.log (default path is /opt/jfrog/artifactory/logs/artifactory-request.log on CentOS).

• Search for lines with 403 — you’ll see messages like:
  • user does not have permission to deploy to repository '<repo-key>' (permission issue)
  • repository '<repo-key>' not found (wrong repo key in your Docker command or Nginx config)
  • invalid repository type for docker request (you used a non-Docker repo type)

5. Test with Curl to Isolate the Problem #

Rule out Docker-specific issues by testing the Artifactory Docker API directly with curl:

• Test pull access: curl http://your-artifactory-host/docker/<repo-key>/v2/_catalog
• Test push access (replace with your Artifactory username and API key):

  curl -u your-username:your-api-key -X POST http://your-artifactory-host/docker/<local-repo-key>/v2/test-image/blobs/uploads/
  

If curl returns 403, the problem is in Artifactory/Nginx. If curl works, then the issue is with your Docker client setup (double-check the insecure registry or Docker login credentials).

6. Confirm Repository Types Are Correct #

Make sure each repo is configured as a Docker type in Artifactory:

• Local repo: When creating, select Docker under Package Type.
• Remote repo: Select Docker and set the Remote Repository URL to https://registry-1.docker.io (for Docker Hub).
• Virtual repo: Select Docker and include your local/remote Docker repos in the Repositories Included in Virtual Repository list.

内容的提问来源于stack exchange，提问作者a.sheth