Registry upload access denied

[mwullink]

Hi,

I'm trying to deploy the talos factory docker image using docker compose script below, but i keep getting access denied when uploading to custom registry. i'm not sure the talos factory is using the correct docker credentials.
is mapping docker config to /root/.docker/config.json in the container the correct method for doing this?

talos-factory:
    image: ghcr.io/siderolabs/image-factory:v0.8.4
    command:
      [
        "--image-registry=xxx:5004",
        "--insecure-image-registry=true",
        "--external-url=https://ghcr.io",
        "--schematic-service-repository=ghcr.io/xxx/talos",
        "--installer-internal-repository=ghcr.io/xxx/talos",
        "--installer-external-repository=ghcr.io/xxx/talos",
        "--cache-repository=ghcr.io/xxx/talos",
        "--cache-signing-key-path=/var/factory/cache-signing-key.key",
        "--http-port=0.0.0.0:9000"
      ]
    ports:
      - 9000:9000
    volumes:
      - /xxx/talos/talos-tools/factory-data:/var/factory
      - /home/xxx/.docker/config.json:/root/.docker/config.json
    restart: unless-stopped

talos-factory_1             | {"level":"error","ts":1758537714.240222,"caller":"http/http.go:203","msg":"request","frontend":"http","method":"POST","path":"/ui/wizard","status":500,"duration":1.475759998,"error":"Post \"https://ghcr.io/v2/xxx/talos/blobs/uploads/\": GET https://ghcr.io/token?scope=repository%3Axxx%2Ftalos%3Apull&scope=repository%3Axxx%2Ftalos%3Apush%2Cpull&service=ghcr.io: DENIED: requested access to the resource is denied","stacktrace":"github.com/siderolabs/image-factory/internal/frontend/http.NewFrontend.NewFrontend.func1.(*Frontend).wrapper.func46\n\t/src/internal/frontend/http/http.go:203\ngithub.com/siderolabs/image-factory/internal/frontend/http.NewFrontend.NewFrontend.func1.Handler.func47.1\n\t/go/pkg/mod/github.com/slok/[email protected]/middleware/httprouter/httprouter.go:18\nnet/http.HandlerFunc.ServeHTTP\n\t/usr/local/go/src/net/http/server.go:2322\ngithub.com/slok/go-http-metrics/middleware/std.Handler.func1.1\n\t/go/pkg/mod/github.com/slok/[email protected]/middleware/std/std.go:27\ngithub.com/slok/go-http-metrics/middleware.Middleware.Measure\n\t/go/pkg/mod/github.com/slok/[email protected]/middleware/middleware.go:142\ngithub.com/slok/go-http-metrics/middleware/std.Handler.func1\n\t/go/pkg/mod/github.com/slok/[email protected]/middleware/std/std.go:26\nnet/http.HandlerFunc.ServeHTTP\n\t/usr/local/go/src/net/http/server.go:2322\ngithub.com/siderolabs/image-factory/internal/frontend/http.NewFrontend.NewFrontend.func1.Handler.func47\n\t/go/pkg/mod/github.com/slok/[email protected]/middleware/httprouter/httprouter.go:21\ngithub.com/julienschmidt/httprouter.(*Router).ServeHTTP\n\t/go/pkg/mod/github.com/julienschmidt/[email protected]/router.go:387\nnet/http.serverHandler.ServeHTTP\n\t/usr/local/go/src/net/http/server.go:3340\nnet/http.(*conn).serve\n\t/usr/local/go/src/net/http/server.go:2109"}

[frezbo]

ghcr.io is different, it needs GITHUB_TOKEN env var mapped to the container

[mwullink]

i tried using GITHUB_TOKEN env and the token from ~/.docker/config.json but i get the same result.

[smira]

In that case the problem should be on your end, like the token is wrong, it is not granted access, etc.

There is no issue in the Image Factory.