Denied: requested access to the resource is denied

Binder
1

Hello, I built my binderhub using the “zero to binderhub” guide, where as a repository I chose the docker hub. I created my docker hub account to which I can push images manually via ‘docker push’. But despite having

registry:
username: <user>
password: <pass>

in my secret.yaml (where instead of and are my docker hub credentials and

config:
BinderHub:
use_registry: true
image_prefix: <user>/binder-meta-

in my config.yaml, my image building process ends with an error message

...
Succesfully built ....
Succesfully tagged ...
denied: requested access to the resource is denied

where docker hub seems to deny the image upload request. The docker image is actually created and I can seem him in the docker images output, with a name and tag binder-<repository-name>-<some-random-hexa-string>, and if I try to docker push it, I get the exact same request denied error.

BUT, if I use docker tag <image-ID> <user>/myimg command to properly tag my image, suddenly docker push works. So somehow, despite setting image tagging in the config file, binderhub improperly tags the image and the docker refuses the upload.

I have actually tried this on 2 independent linux machines, and both give the same error, until I fix the tag, then docker push works. Any idea how to set proper tagging in binderhub (config files, or even hard coding it to helm chart or source code is fine for me)…

1 Like
2

Can you give an example of the image name that Binder creates, and the tag that you create?

Could you also check the formatting of your config snippets? It looks like the indentation has been lost, so it’s not possible to verify it’s correct.

3

I have fixed the indentation, have not noticed it, thanks.

So the repo I am trying to build and run is

Binderhub builds it and in docker images it looks like this

REPOSITORY    TAG    IMAGE ID      CREATED        SIZE
karthik-2dbinder-2dtest-649047      db6941e4903ed4e97d65e6c67b0d43c624659327   01910bf4b338        7 days ago          4.59GB

this fails with the denied message, and as well docker push karthik-2dbinder-2dtest-649047 fails

The push refers to repository [docker.io/library/karthik-2dbinder-2dtest-649047]
3ffd43eca7ef: Preparing 
b10c7b908355: Preparing 
d40af16b1728: Preparing 
569d20e4aa75: Preparing 
5e3705530571: Preparing 
10fd089dbc61: Waiting 
d1c21562caea: Waiting 
1ed76fef9fc9: Waiting 
1a98fe4a1f90: Waiting 
8d4dfe245376: Waiting 
94fbe0c58204: Waiting 
ec188681b176: Waiting 
ffa738756565: Waiting 
d33dcd43966f: Waiting 
5cfb3901fe5a: Waiting 
9c887d0dd6cb: Waiting 
8673f31aaa43: Waiting 
d8895f782cd1: Waiting 
1fe356c64d3b: Waiting 
e2a8a00a83b2: Waiting 
denied: requested access to the resource is denied

If however I do

docker tag 01910bf4b338 nikl123/testimg2

now there is a new image the docker images output

REPOSITORY          TAG       IMAGE ID           CREATED      SIZE
karthik-2dbinder-2dtest-649047      db6941e4903ed4e97d65e6c67b0d43c624659327   01910bf4b338        7 days ago          4.59GB
nikl123/testimg2        latest     01910bf4b338    7 days ago      4.59GB

and if I do docker push nikl123/testimg2 then it starts pushing ok

The push refers to repository [docker.io/nikl123/testimg2]
3ffd43eca7ef: Pushing   2.56kB
b10c7b908355: Pushing  9.584MB/40.32MB
d40af16b1728: Pushing  101.4kB
569d20e4aa75: Pushing   98.3kB
5e3705530571: Pushing  993.8kB
10fd089dbc61: Waiting 
d1c21562caea: Waiting 
1ed76fef9fc9: Waiting 
1a98fe4a1f90: Waiting 
8d4dfe245376: Waiting 
94fbe0c58204: Waiting 
ec188681b176: Waiting 
ffa738756565: Waiting 
d33dcd43966f: Waiting 
5cfb3901fe5a: Waiting 
9c887d0dd6cb: Waiting 
8673f31aaa43: Waiting 
d8895f782cd1: Waiting 
1fe356c64d3b: Waiting 
e2a8a00a83b2: Waiting

The config.yaml clearly states that I want the built docker images to be named nikl123/binder-meta-<something>, but the final image isnt named this way. I wonder if you guys end up with one extra image in the docker images output, that has the correct name, or do you see the same first image that I see and right below the same image, but retagged, which would indicate that binderhub fails on retagging the image rather than naming it wrongly in the first place…

4

mybinder.org recently had a problem with using Docker Hub and this was due to Docker Hub changing their URLs. Can you try explicitly referencing the registry URL like in the config here? explicity set dockerconfig to point towards registry-1.docker.io by MridulS · Pull Request #1937 · jupyterhub/mybinder.org-deploy · GitHub

5

The indentation in your original post is still missing. Could you post your current config again?

6

This unfortunately did not help. This is definitely a problem with re-tagging freshly built images properly, because as I have said docker tag... command fixes the issue with pushing images to the docker hub. It is very strange that no one encounters this, I tried installing the most basic binderhub on 3 different linux systems, and all have the same issue, so it is doubtful to me that other people following the zero to binderhub tutorial would not have any issues…

7

I just experienced the very same.

I am using Nixos and installed the most recent python39Packages.jupyter-repo2docker.
I experience the very same described problem (and am very lucky to see that I can still tag and push it)