Which role is needed to pull an image from a container registry?

Problem to solve

I pull an image with a Project Access Token with role Reporter in my self-hosted gitlab:

echo "$JLOT_PULL_TOKEN" | docker login ${REGISTRY} -u token --password-stdin
docker pull ${REGISTRY}/${IMAGE_NAME}:${VERSION}

This works.

But if I ran the same code but with a token with role Planner or Guest, it does NOT work. The Login succeeds, but the pull answers:

WARNING! Your credentials are stored unencrypted in '/home/janning/.docker/config.json'.
Configure a credential helper to remove this warning. See
https://docs.docker.com/go/credential-store/

Login Succeeded
Error response from daemon: pull access denied for ***, repository does not exist 
or may require 'docker login': denied: requested access to the resource is denied

Steps to reproduce

Just switch from Role Reporter to role Guest or Planner.

Configuration

The documentation states that role planner is enough.

Versions

  • Self-managed
  • Dedicated

Versions
v18.1.1-ee