使用 gitlab 时，docker 推送因“未经授权：需要身份验证”而失败

Question

尝试使用 gitlab-runner 推送到 Gitlab 注册表时出现以下错误：

\n\n

unauthorized: authentication required \nERROR: Build failed: exit status 1\n

\n\n

虽然：

\n\n

$ docker login -u gitlab-ci-token -p $CI_BUILD_TOKEN git.COMPANY.com\nLogin Succeeded\n

\n\n

从我的本地环境进行构建和推送效果很好，这表明问题与运行程序运行的主机（gitlab-ci3）有关，或者可能与正在使用的用户有关：

\n\n

$ echo $USER\ngitlab-runner\n

\n\n

在组中：

\n\n

docker:x:999:gitlab-runner\ngitlab-runner:x:998:\n

\n\n

我已经尝试过docker 未经授权：需要身份验证 - 成功登录后推送但没有成功。\n也许 gitlab-runner 没有 root config.json 的权限是原因？：

\n\n

$ cat /root/.docker/config.json\n cat: /root/.docker/config.json: Permission denied\n

\n\n

除了解决这个问题之外，如果您能为我提供如何更好地调试此错误以供将来使用，这将非常有帮助。

\n\n

我正在使用 GitLab 企业版 8.13.1-ee、Docker 1.12.3、gitlab-ci-multi-runner 1.7.1

\n\n

亚特实验室输出：

\n\n

Running with gitlab-ci-multi-runner 1.7.1 (f896af7)\nUsing Shell executor...\nRunning on gitlab-ci3...\nFetching changes...\nHEAD is now at cfe0a35 gitlab-ci.yml - testing\nChecking out cfe0a356 as master...\n$ docker info\nContainers: 0\n Running: 0\n Paused: 0\n Stopped: 0\nImages: 39\nServer Version: 1.12.3\nStorage Driver: aufs\n Root Dir: /var/lib/docker/aufs\n Backing Filesystem: extfs\n Dirs: 30\n Dirperm1 Supported: false\nLogging Driver: json-file\nCgroup Driver: cgroupfs\nPlugins:\n Volume: local\n Network: host null overlay bridge\nSwarm: inactive\nRuntimes: runc\nDefault Runtime: runc\nSecurity Options: apparmor\nKernel Version: 3.13.0-96-generic\nOperating System: Ubuntu 14.04.5 LTS\nOSType: linux\nArchitecture: x86_64\nCPUs: 4\nTotal Memory: 7.612 GiB\nName: gitlab-ci3\nID: 6QWV:RQFD:4RWJ:D4CF:QN2M:MHKK:TABD:JD3F:3W7R:MCNA:4NHO:26VA\nDocker Root Dir: /var/lib/docker\nDebug Mode (client): false\nDebug Mode (server): false\nRegistry: https://index.docker.io/v1/\nWARNING: No swap limit support\nInsecure Registries:\n 127.0.0.0/8\n$ docker-compose rm --all --force\nThe TESTS variable is not set. Defaulting to a blank string.\n--all flag is obsolete. This is now the default behavior of `docker-compose rm`\nNo stopped containers\n$ docker login -u gitlab-ci-token -p $CI_BUILD_TOKEN git.COMPANY.com\nLogin Succeeded\n$ docker build --pull -t $CONTAINER_IMAGE .\nSending build context to Docker daemon 557.1 kB\n.\n.\n.\nSending build context to Docker daemon 18.05 MB\n\n\nStep 1 : FROM ruby:latest\nlatest: Pulling from library/ruby\nDigest: sha256:21a22bcc774f25c99bf5f27f16f8b4666f4ccbcb457e06f7a7e06a4728ea640b\nStatus: Image is up to date for ruby:latest\n ---> 45766fabe805\nStep 2 : RUN apt-get update && curl -sL https://deb.nodesource.com/setup_5.x | bash - && apt-get install -y git nodejs && rm -rf /var/lib/apt/lists/*\n ---> Using cache\n.\n.\n.\nStep 23 : \n ---> Using cache\n ---> b36460381a03\nSuccessfully built b36460381a03\n$ docker login -u gitlab-ci-token -p $CI_BUILD_TOKEN git.COMPANY.com\nLogin Succeeded\n$ echo $USER\ngitlab-runner\n$ cat ~/.docker/config.json\n{\n  "auths": {\n    "git.COMPANY.com": {\n      "auth": "EDW..."\n    }\n  }\n\n $ cat /root/.docker/config.json\n cat: /root/.docker/config.json: Permission denied\n\n$ docker push $CONTAINER_IMAGE\nThe push refers to a repository [git.COMPANY.com:4567/ui/PROJECT]\nfc4a22a92ee5: Preparing\n.\n.\n.\n149636c85012: Waiting\nf96222d75c55: Waiting\nunauthorized: authentication required\nERROR: Build failed: exit status 1\n

\n\n

.gitlab-ci.yml：

\n\n

before_script:\n  - docker info\nstages:\n  - build\n  - test\nvariables:\n  CONTAINER_IMAGE: git.COMPANY.com:4567/ui/PROJECT:$CI_BUILD_REF_NAME\nbuild:\n  tags:\n   - spec_work\n  stage: build\n  script:\n      - docker-compose rm --all --force\n      - docker login -u gitlab-ci-token -p $CI_BUILD_TOKEN git.COMPANY.com\n      - docker build --pull -t $CONTAINER_IMAGE .\n      - docker login -u gitlab-ci-token -p $CI_BUILD_TOKEN git.COMPANY.com\n      - echo $USER\n      - cat ~/.docker/config.json\n      - docker push $CONTAINER_IMAGE\ntest:\n  stage: test\n  tags:\n    - spec_work\n  script:\n    - docker-compose rm --all --force\n    - docker-compose down\n    - docker-compose build\n    - docker-compose up --abort-on-container-exit --force-recreate\n    - (exit `docker-compose ps | grep \'test\' | grep -Po \'Exit (\\d+)\' | cut -d " " -f 2`)\n

\n\n

Docker 配置.json：

\n\n

root@gitlab-ci3 (Ubuntu 14.04) \xe2\x9e\x9c  ~ cat .docker/config.json\n{\n  "auths": {\n    "https://git.COMPANY.com": {\n      "auth": "EDW..."\n    }\n  }\n}\n

\n\n

还尝试过：

\n\n

{\n  "auths": {\n    "https://git.COMPANY.com/ui/PROJECT": {\n      "auth": "EDW..."\n    }\n  }\n}\n

\n

Answer 1

来自Docker-in-Docker 和 Gitlab 的共享运行器，用于构建 docker 镜像并将其推送到注册表

基于：

- docker version
- docker build -t $CI_REGISTRY_IMAGE:latest .
- docker tag $CI_REGISTRY_IMAGE:latest $CI_REGISTRY_IMAGE:$CI_BUILD_TAG
- docker login -u gitlab-ci-token -p $CI_BUILD_TOKEN $CI_REGISTRY
- docker push $CI_REGISTRY_IMAGE:$CI_BUILD_TAG

我用过：

- docker version
- docker build -t $CI_REGISTRY_IMAGE:latest .
- docker tag $CI_REGISTRY_IMAGE:latest $CI_REGISTRY_IMAGE:$CI_BUILD_REF_NAME
- docker login -u gitlab-ci-token -p $CI_BUILD_TOKEN $CI_REGISTRY
- docker push $CI_REGISTRY_IMAGE:$CI_BUILD_REF_NAME

在 .gitlab-ci.ym 的构建部分。

现在推送效果很好。

至于为什么它有效，我不知道。如果有人知道为什么此更改解决了此问题，请发表评论，我确实想知道原因。

谢谢！