Docker Core
The registry refused the pull because the repository is private or unknown.
pull-access-deniedReviewed for reference consistency: August 11, 2026
The registry refused the pull because the repository is private or unknown.
What pull-access-denied Means
The pull-access-denied error on the Docker Core indicates the registry refused the pull because the repository is private or unknown.. This typically occurs due to the repository is private and the caller has no valid session for that registry.
Registries deliberately give anonymous callers the same denial for a private repository and a nonexistent one, so the daemon's message lists both possibilities. The pull never starts; no layers download and the local image store stays untouched while credentials are sorted out.
How to fix pull-access-denied
General informational guidance, not professional advice. Commands can affect your system or data — back up first and proceed at your own risk. FixerCode is an independent reference, not affiliated with any vendor mentioned.
Show stored registry credentials
The auths section lists which registry hosts hold sessions; a failing host absent from the list means the pull went out anonymously.
cat ~/.docker/config.jsonSee whether the image exists locally
A local copy means the denial only blocks remote refresh; an absent image plus the denial points at credentials or naming.
docker image inspect <registry>/<namespace>/<repo>:<tag>
Technical Background
The daemon composes this message from the registry's denial answer, keeping the ambiguity by design: confirming existence to an anonymous caller would leak which private names are real.
The practical consequence is that a typo and a permissions gap produce identical output, so the reference check runs in both directions: whether the repository exists under that exact name, and whether the current credential set has read access to it.
Common Causes
- The repository is private and the caller has no valid session for that registry
- The image name or namespace is misspelled and resolves to nothing accessible
- Stored credentials expired or were issued for a different registry host
- The account lacks read permission on the organization's repository
Typical Scenarios
- Running an image from a private namespace on a machine that never logged in
- A compose file referencing a moved or renamed repository under the old name
- A CI runner whose registry credentials expired between pipeline stages
What to Know
Because the same wording covers wrong-name and wrong-credentials cases, the useful comparison is between an authenticated session and the exact reference string in the compose file or command; the divergence points at whichever half changed.
Frequently Asked Questions
Common questions about Docker pull-access-denied error
Registries treat existence as sensitive: confirming a private name to strangers would let outsiders enumerate repositories, so both cases collapse into one denial.
Only when the original failure was a transient registry error; expired or missing credentials reproduce the denial identically on every attempt.
Related Error Codes
The registry answered with a 401 asking the client to authenticate first.
The server recognized the caller but refused the specific repository action.
The registry has no manifest for the exact repository and tag requested.
Related Errors From Other Categories
Similar error codes documented across different platforms and systems