Access Denied to Docker Registry using local runner

GitLab CI/CD
1

I’m trying to debug an issue with my tests on my laptop using Gitlab’s local runner, which seem great (and were one of the features that convinced us to migrate from Circle). Unfortunately, I’m running into permission errors when gitlab-runner tries to pull the images from the Gitlab registry:

> gitlab-runner exec docker cypress

Running with gitlab-runner 11.1.0 (081978aa)
Using Docker executor with image cypress/browsers:chrome67 ...
Starting service registry.gitlab.com/espark-learning/espark-dev-db:latest ...
Pulling docker image registry.gitlab.com/espark-learning/espark-dev-db:latest ...
ERROR: Preparation failed: Error response from daemon: Get https://registry.gitlab.com/v2/espark-learning/espark-dev-db/manifests/latest: denied: access forbidden (executor_docker.go:168:1s)

My config.toml file looks correct:

> cat ~/.gitlab-runner/config.toml

concurrent = 1
check_interval = 0

[[runners]]
  name = "Koppel.local"
  url = "https://gitlab.com/"
  token = "$TOKEN_FROM_PROJECT_CI_SETTINGS"
  executor = "docker"
  [runners.docker]
    tls_verify = false
    image = "gnarmis/ruby-ci:2.3.7-jessie-node-browsers-qt"
    privileged = false
    disable_cache = false
    volumes = ["/cache"]
    shm_size = 0
  [runners.cache]

I’ve also tried running docker login registry.gitlab.com; that works, but doesn’t solve the issue.

Any help would be much appreciated!

2

If I rerun the registration step for the runner, it can access the first of two service Docker images the first time. It then fails to access the registry for the second service, and then (disconcertingly) when it retries it can’t access the first image either:

Running with gitlab-runner 11.1.0 (081978aa)
Using Docker executor with image cypress/browsers:chrome67 ...
Starting service registry.gitlab.com/espark-learning/espark-dev-db:latest ...
Pulling docker image registry.gitlab.com/espark-learning/espark-dev-db:latest ...
Using docker image sha256:8f375efe826e717699a94e3061027ae1ff6f3cabf95039d8edeac70f3ef585e5 for registry.gitlab.com/espark-learning/espark-dev-db:latest ...
Starting service registry.gitlab.com/espark-learning/core/build:14cc27f81d8429482f96a2de6507f98344fe4375 ...
Pulling docker image registry.gitlab.com/espark-learning/core/build:14cc27f81d8429482f96a2de6507f98344fe4375 ...
ERROR: Preparation failed: Error response from daemon: Get https://registry.gitlab.com/v2/espark-learning/core/build/manifests/14cc27f81d8429482f96a2de6507f98344fe4375: denied: access forbidden (executor_docker.go:168:0s)
Will be retried in 3s ...
Using Docker executor with image cypress/browsers:chrome67 ...
Starting service registry.gitlab.com/espark-learning/espark-dev-db:latest ...
Pulling docker image registry.gitlab.com/espark-learning/espark-dev-db:latest ...
ERROR: Preparation failed: Error response from daemon: Get https://registry.gitlab.com/v2/espark-learning/espark-dev-db/manifests/latest: denied: access forbidden (executor_docker.go:168:0s)
3

This seems to have fixed itself without any intervention on my part.