How to Resolve “Pull Access Denied for registry.gitlab.com” Error

If you're migrating your private GitLab repositories to a group, like I did for my personal business, you may encounter an error message like this in your pipelines:

WARNING: Failed to pull image with policy "always": Error response from daemon: pull access denied for registry.gitlab.com/merisia/tools/git-rsync, repository does not exist or may require 'docker login': denied: requested access to the resource is denied (manager.go:237:0s)

ERROR: Job failed: failed to pull image "registry.gitlab.com/merisia-inc/outils/git-rsync:1.2.0" with specified policies [always]: Error response from daemon: pull access denied for registry.gitlab.com/merisia/tools/git-rsync, repository does not exist or may require 'docker login': denied: requested access to the resource is denied (manager.go:237:0s)

Despite confirming that the URL and tag exist in the repository's Container Registry, the problem persists. 😓

After conducting some research, I discovered a related StackOverflow question where another user faced a similar issue. Although no solution was provided, I stumbled upon a helpful clue. The user encountered the same issue when moving a private repository to a group. 🤔

The thread mention the DOCKER_AUTH_CONFIG variable, which picked my curiosity. So I began to look on it and I found this documentation from a team of UToronto that helped me solve my problem. 🤩

As it's not impossible that I encountered again this problem in a distant future,I decided to share the solution I used through this blog post. I'll skip the detailed explanations, since the UToronto team has already covered the necessary commands. 🤗

Solution

Encode your GitLab credentials in base64

# The use of "-n" - prevents encoding a newline in the password.
echo -n 'GITLAB_USERNAME:GITLAB_PASSWORD' | base64

Create the DOCKER_AUTH_CONFIG variable in your CI/CD group settings

Go to your GitLab group (or project).
Under Settings > CI/CD > Variable, click the Add variable button.
Set the key as DOCKER_AUTH_CONFIG and set the content with the following JSON:

{
    "auths": {
        "registry.gitlab.com": {
            "auth": "(Base64 content from above)"
        }
    }
}

Make sure to uncheck the Protect variable and Expand variable reference options as they are optionals.
Click the Add variable button to create this new variable.