Access Denied to GitLab Dependency Proxy

GitLab CI/CD
, ,
1

I’m unable to pull images from GitLab dependency_proxy, both inside the CI/CD processes and from my command line docker.

From my machine:
I have performed the docker login with my username/password (I have the access to the group as administrator). The command completes successfully.
Then I try to perform a

docker pull "git.cedac.com/aggregatori/dependency_proxy/containers/alpine:latest"

(where aggregatori is the group name and git.cedac.com is the hostname of my on premise instance). I only obtain the message

Error response from daemon: pull access denied for git.cedac.com/aggregatori/dependency_proxy/containers/alpine, repository does not exist or may require 'docker login': denied: requested access to the resource is denied

On the gitlab machine I have the following logs:

2021-10-29_12:28:59.78790 time="2021-10-29T14:28:59.787+02:00" level=warning msg="error authorizing context: authorization token required" correlation_id=01FK60CNG327YAVNW74RAB6PT8 go_version=go1.16.4 root_repo=
2021-10-29_12:28:59.78796 {"content_type":"application/json","correlation_id":"01FK60CNG327YAVNW74RAB6PT8","duration_ms":8,"host":"git.cedac.com","level":"info","method":"GET","msg":"access","proto":"HTTP/1.1","referrer":"","remote_addr":"127.0.0.1:40234","remote_ip":"127.0.0.1","status":401,"system":"http","time":"2021-10-29T14:28:59.787+02:00","ttfb_ms":8,"uri":"/v2/","user_agent":"docker/20.10.8 go/go1.16.6 git-commit/75249d8 kernel/5.10.47-linuxkit os/linux arch/amd64 UpstreamClient(Docker-Client/20.10.8 \\(darwin\\))","written_bytes":87}
2021-10-29_12:29:00.29012 time="2021-10-29T14:29:00.290+02:00" level=warning msg="error authorizing context: insufficient scope" correlation_id=01FK60CNZZBMASJP2TPMH9K2K6 go_version=go1.16.4 root_repo=aggregatori vars_name=aggregatori/dependency_proxy/containers/alpine vars_reference=latest
2021-10-29_12:29:00.29030 {"content_type":"application/json","correlation_id":"01FK60CNZZBMASJP2TPMH9K2K6","duration_ms":2,"host":"git.cedac.com","level":"info","method":"HEAD","msg":"access","proto":"HTTP/1.1","referrer":"","remote_addr":"127.0.0.1:40238","remote_ip":"127.0.0.1","status":401,"system":"http","time":"2021-10-29T14:29:00.290+02:00","ttfb_ms":2,"uri":"/v2/aggregatori/dependency_proxy/containers/alpine/manifests/latest","user_agent":"docker/20.10.8 go/go1.16.6 git-commit/75249d8 kernel/5.10.47-linuxkit os/linux arch/amd64 UpstreamClient(Docker-Client/20.10.8 \\(darwin\\))","written_bytes":189}
2021-10-29_12:29:00.45978 time="2021-10-29T14:29:00.459+02:00" level=warning msg="error authorizing context: insufficient scope" correlation_id=01FK60CP581G24FWRWRKBRYMJ4 go_version=go1.16.4 root_repo=aggregatori vars_name=aggregatori/dependency_proxy/containers/alpine vars_reference=latest
2021-10-29_12:29:00.46009 {"content_type":"application/json","correlation_id":"01FK60CP581G24FWRWRKBRYMJ4","duration_ms":3,"host":"git.cedac.com","level":"info","method":"GET","msg":"access","proto":"HTTP/1.1","referrer":"","remote_addr":"127.0.0.1:40240","remote_ip":"127.0.0.1","status":401,"system":"http","time":"2021-10-29T14:29:00.459+02:00","ttfb_ms":3,"uri":"/v2/aggregatori/dependency_proxy/containers/alpine/manifests/latest","user_agent":"docker/20.10.8 go/go1.16.6 git-commit/75249d8 kernel/5.10.47-linuxkit os/linux arch/amd64 UpstreamClient(Docker-Client/20.10.8 \\(darwin\\))","written_bytes":189}

I got a similar problem inside the CI/CD using the environment variables in order to authenticate and get the image.

Can anyone help me?
Thank you in advance

Mauro

2

I have the same problem. Did you find a solution? I’m just trying out the proxy-cache for alpine-latest from the command line on my windows machine, and I sort of got the exact same logs as well…

3

Ok, I found it. The Dependency Proxy uses my gitlab server, not the registry server name and this can not be changed(!) The dependecy proxy server path can be found in the gitlab user interface under the group->Operate->Dependence Proxy.

" If you also use GitLab’s Container Registry (to store images you build), take note that Dependency Proxy is entirely separate and has a different URL. Whereas Container Registry is normally exposed on its own subdomain (e.g. registry.example.com ), Dependency Proxy is accessed via the same hostname as the GitLab web UI."

from https://www.howtogeek.com/devops/how-to-enable-gitlabs-dependency-proxy-for-docker-images/