Please provide as much information as possible. At least, this should include a description of your issue and steps to reproduce the problem. If possible please provide a summary of what steps or workarounds you have already tried, and any docs or articles you found (un)helpful.

Problem you have encountered:

When using BuildKit with Docker 18.09 using base images FROM gcr.io, BuildKit fails.
From the explanation from a Moby engineer [1], this seems to be an issue related to authentication handling on GCR that doesn't match what BuildKit is expecting.

What you expected to happen:

BuildKit to being asked for an authentication method instead of directly returning 403.

Steps to reproduce:

1. Create a Dockerfile
2. Use a FROM directive to pull an already existing image from a private repository in gcr.io
3. Set the 'credshelper' to use GCR hostnames [2]
4. Run `DOCKER_BUILDKIT=1 docker build .`
5. After waiting long time and pressing CTRL-C and the error is printed

Command output:
failed to copy: httpReaderSeeker: failed open: unexpected status code https://gcr.io/v2/...: 403 Forbidden

Note: "..." used for private information obfuscation.

Other information (workarounds you have tried, documentation consulted, etc):

[1] https://github.com/moby/buildkit/issues/720#issuecomment-440092509
[2] https://github.com/docker/docker-credential-helpers

Issue 123043691

Links (7)

Issue metadata