Docker Core
The server recognized the caller but refused the specific repository action.
denied-requested-accessReviewed for reference consistency: August 11, 2026
The server recognized the caller but refused the specific repository action.
What denied-requested-access Means
The denied-requested-access error on the Docker Core indicates the server recognized the caller but refused the specific repository action.. This typically occurs due to the authenticated account lacks push permission on the target namespace.
This line is the registry's own denial body, usually attached to a push. Authentication succeeded, yet the account lacks write rights on the namespace, the namespace belongs to someone else, or the repository is read-only. The daemon passes the registry's wording through next to its own envelope.
How to fix denied-requested-access
General informational guidance, not professional advice. Commands can affect your system or data — back up first and proceed at your own risk. FixerCode is an independent reference, not affiliated with any vendor mentioned.
Check the namespace's public visibility
A search on Docker Hub shows whether the namespace exists publicly, separating a claimed name from a mistyped one.
docker search <namespace>/<repo>Read the HTTP status the registry returns
A status-only manifest request shows the code the registry assigns to this caller and repository pair.
curl -s -o /dev/null -w '%{http_code}\n' https://<registry-host>/v2/<namespace>/<repo>/manifests/<tag>
Technical Background
Denied sits one step past unauthorized in the registry's model: identity is established, authorization fails. That placement makes the registry's permission page the deciding context rather than the client config.
Push flows surface this most because write access is the tighter grant. Pulls on public namespaces stay anonymous-friendly while pushes always require an explicitly granted role.
Common Causes
- The authenticated account lacks push permission on the target namespace
- The repository path points into another user's or organization's namespace
- The access token's scope omits write for this repository
- The namespace owner enabled read-only or compliance restrictions
Typical Scenarios
- Pushing under an organization namespace the personal account has no write role for
- A CI service account whose token scope covers pull but not push
- A first push to a namespace whose name was already claimed by another user
What to Know
Since identity is valid, the same session typically succeeds for pull and fails for push, which isolates the problem to write permissions on that exact namespace rather than to credentials in general.
Frequently Asked Questions
Common questions about Docker denied-requested-access error
Nothing the client does changes it. Namespace ownership is registry-side state; only the owner or an organization administrator can grant the write role the push needs.
The daemon treats registry bodies as authoritative detail and forwards them after its own envelope, so troubleshooting happens against the registry's vocabulary.
Related Error Codes
The registry refused the pull because the repository is private or unknown.
The registry answered with a 401 asking the client to authenticate first.
The registry has no manifest for the exact repository and tag requested.
Related Errors From Other Categories
Similar error codes documented across different platforms and systems