Compose image pulls fail from Docker Hub

Docker Engine Compose
1

I’m running into unexpected “incorrect username or password” errors pulling images from Docker Hub via docker-compose - despite the fact that I’m logged in.

For example, when trying to pull an image of Apache Zookeeper I see:

$ docker-compose pull zookeeper
Pulling zookeeper (wurstmeister/zookeeper:latest)...
ERROR: Get https://registry-1.docker.io/v2/wurstmeister/zookeeper/manifests/latest: unauthorized: incorrect username or password

Yet, I can pull without any problems using the Docker Engine CLI:

$ docker pull wurstmeister/zookeeper:latest
latest: Pulling from wurstmeister/zookeeper

a3ed95caeb02: Already exists 
ef38b711a50f: Already exists 
e057c74597c7: Already exists 
666c214f6385: Already exists 
c3d6a96f1ffc: Already exists 
3fe26a83e0ca: Already exists 
3d3a7dd3a3b1: Already exists 
f8cc938abe5f: Already exists 
9978b75f7a58: Already exists 
4d4dbcc8f8cc: Already exists 
00503e1c1e7b: Already exists 
92be7a90bf66: Already exists 
dc99318fa8e1: Already exists 
ede3f5c078c0: Already exists 
e7dbd0c0c76d: Already exists 
471adb2e9b00: Already exists 
Digest: sha256:5c04a0363196916b51cde29a55f40edcf300334706fd17192126251b9d838cdd
Status: Image is up to date for wurstmeister/zookeeper:latest

Any thoughts as to what might fix the issue? This is happening on an Ubuntu Xenial machine in EC2 running the current stable versions of engine and compose (1.11.2/1.7.1) and the newest engine/compose release candidates (1.12.0-rc2/1.8.0-rc1).

In the logs I see this:

$ sudo journalctl -fu docker.service
Jun 25 02:15:58 ip-10-1-1-175 dockerd[13606]: time="2016-06-25T02:15:58.852976502Z" level=debug msg="Calling POST /v1.22/images/create?tag=latest&fromImage=wurstmeister%2Fzookeeper"
Jun 25 02:15:58 ip-10-1-1-175 dockerd[13606]: time="2016-06-25T02:15:58.853450580Z" level=debug msg="Trying to pull wurstmeister/zookeeper from https://registry-1.docker.io v2"
Jun 25 02:15:59 ip-10-1-1-175 dockerd[13606]: time="2016-06-25T02:15:59.606529649Z" level=error msg="Error trying v2 registry: Get https://registry-1.docker.io/v2/wurstmeister/zookeeper/manifests/latest: unauthorized: incorrect username or password"
Jun 25 02:15:59 ip-10-1-1-175 dockerd[13606]: time="2016-06-25T02:15:59.606910661Z" level=error msg="Attempting next endpoint for pull after error: Get https://registry-1.docker.io/v2/wurstmeister/zookeeper/manifests/latest: unauthorized: incorrect username or password"
Jun 25 02:15:59 ip-10-1-1-175 dockerd[13606]: time="2016-06-25T02:15:59.607096241Z" level=debug msg="Skipping v1 endpoint https://index.docker.io because v2 registry was detected"
Jun 25 02:15:59 ip-10-1-1-175 dockerd[13606]: time="2016-06-25T02:15:59.607282506Z" level=error msg="Handler for POST /v1.22/images/create returned error: Get https://registry-1.docker.io/v2/wurstmeister/zookeeper/manifests/latest: unauthorized: incorrect username or password"
2

Specify the image namespace also.

docker-compose pull wurstmeister/zookeeper

3

Determining the image to pull isn’t the issue. If you take a look at the docker-compose snippet, it has correctly deduced the pull spec as wurstmeister/zookeeper:latest. Plus, docker-compose pull doesn’t take paths like docker pull does. Instead it takes zero or more service names which need to be in the docker-compose.yml project files. So, that part works.

The error message is about authentication (“incorrect username or password”). But authentication isn’t a problem with the core docker command. So, the question is really: Why is docker-compose not extracting authentication credentials from ~/.docker/config.json in the same way as the docker command?

4

Use docker login before docker-compose.