stark coral
Hey Authentik community! đź‘‹
I'm setting up a new Authentik instance using Docker Compose on a fresh Scaleway server (Ubuntu 24.04, Docker from official repo) and I've run into a peculiar issue specifically with pulling the goauthentik/worker image.
The Problem:
Whenever I (or Docker Compose) try to pull any tag for ghcr.io/goauthentik/worker (I've tried 2024.4.2, 2024.4.1, and latest), I consistently get a "denied" error:
Error response from daemon: Head "https://ghcr.io/v2/goauthentik/worker/manifests/2024.4.2": denied
Using skopeo inspect docker://ghcr.io/goauthentik/worker:2024.4.2 also fails with:
FATA[0000] Error parsing image name "docker://ghcr.io/goauthentik/worker:2024.4.2": Requesting bearer token: invalid status code from registry 403 (Forbidden)
What's strange is:
I can successfully pull ghcr.io/goauthentik/server:2024.4.2 from the same registry without any issues.
I can also pull other public images from ghcr.io (e.g., linuxserver/code-server).
Pulling images from Docker Hub (like postgres, redis, hello-world) works fine.
Basic network connectivity to ghcr.io (ping, curl to the base URL) seems okay from the server.
Troubleshooting I've tried so far:
docker logout ghcr.io (confirmed I was logged out / no credentials removed if not logged in).
Restarting the Docker daemon (sudo systemctl restart docker).
Ensured there's no ~/.docker/config.json for my user that might be interfering.
The skopeo test also points away from a purely local Docker daemon issue.
It really seems to be something specific to the goauthentik/worker image repository on GHCR, or how requests for its manifests are being handled from my server's IP.
Has anyone else experienced this recently, or does a "403 Forbidden" for just the worker image (while the server image pulls fine) ring any bells? Could there be a permissions issue with how the worker images are published on GHCR, or any other suggestions for things I could check?
Thanks in advance for any pointers! 🙏
atomic bane
