Python image on shared runners cannot be pulled from Docker Hub

I have a CI job that looks like this:

stages:
    - test

workflow:
    rules:
        - if: $CI_MERGE_REQUEST_ID
          when: never
        - when: always

test:
    stage: test
    image: python3.8-alpine
    before_script:
        - pip3 install linkchecker
    script:
        - linkchecker --check-extern public/index.html
    artifacts:
        paths:
            - public
    tags:
        - shared

And I’m getting this result:

Running with gitlab-runner 15.1.0~beta.20.g62206bb2 (62206bb2)
  on green-5.shared.runners-manager.gitlab.com/default xS6Vzpvo
Preparing the "docker+machine" executor
00:06
Using Docker executor with image python3.8-alpine ...
Pulling docker image python3.8-alpine ...
WARNING: Failed to pull image with policy "always": Error response from daemon: pull access denied for python3.8-alpine, repository does not exist or may require 'docker login': denied: requested access to the resource is denied (manager.go:203:0s)
ERROR: Job failed: failed to pull image "python3.8-alpine" with specified policies [always]: Error response from daemon: pull access denied for python3.8-alpine, repository does not exist or may require 'docker login': denied: requested access to the resource is denied (manager.go:203:0s)

I’ve tried using my own runners, and changing the image (to linkchecker/linkchecker:latest or python3.8-slim), with no luck. This job worked until recently.

Any ideas?

@dnsmichi Any ideas on this one? It’s really baffling!

This comment on another post suggests that the issue might be about the visibility of the project, and this issue and this one look relevant.

Shared with the runner team; unfortunately, I have no idea where to start looking. If the problem happens with own runners, enabling the debug log and tracing the errors might be an option.

1 Like

I have a similar issue and tracked it down to public repos with restricted docker registry and docker login/pull with a deploy token rather than your gitlab.com credentials. I opened a new issue here: "docker pull" with deploy token fails on registry.gitlab.com - but only on public repos which have restricted docker registry to project members (#370039) · Issues · GitLab.org / GitLab · GitLab

cc @dnsmichi