Failed to copy: httpReadSeeker Forbidden

Docker Engine General
, ,
1

Hello to all,

I am trying to install Tutor (OpenEdX) and I get the following after few lines of successful code execution:

[+] up 0/9
 ⠋ Image docker.io-overhangio/openedx:20.0.5-indigo      Pulling                2.0s
 ⠋ Image docker.io-devture/exim-relay:4.96-r1-0          Pulling                2.0s
 ⠋ Image docker.io-caddy:2.7.4                           Pulling                2.0s
 ⠋ Image docker.io-overhangio-openedx-permissions:20.0.5 Pulling                2.0s
 ⠋ Image docker.io-mysql:8.4.0                           Pulling                2.0s
 ⠋ Image docker.io-overhangio/openedx-mfe:20.1.0-indigo  Pulling                2.0s
 ⠋ Image docker.io-getmeili/meilisearch:v1.8.4           Pulling                2.0s
 ⠋ Image docker.io-mongo:7.0.28                          Pulling                2.0s
 ⠋ Image docker.io-redis:7.4.5                           Pulling                2.0s
failed to copy: httpReadSeeker: failed open: failed to do request: Get "<url here>/docker-images-prod.6aa30f8b08e16409b46e0173d6de2f56.r2.cloudflarestorage.com/registry-v2/docker/registry/v2/blobs/sha256/7a/7a7b2e234b158c1e01eab04f851fc4b1a33296dbaa68c57d11815ee38a3cafaf/data?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=f1baa2dd9b876aeb89efebbfc9e5d5f4%2F20260116%2Fauto%2Fs3%2Faws4_request&X-Amz-Date=20260116T090247Z&X-Amz-Expires=1200&X-Amz-SignedHeaders=host&X-Amz-Signature=1c4566f5ea8ae868bca63b8b98d614020c0aa1a1f6081dfed247fd4cde3541bb": Forbidden
Error: Command failed with status 1: docker compose -f /root/.local/share/tutor/env/local/docker-compose.yml -f /root/.local/share/tutor/env/local/docker-compose.prod.yml --project-name tutor_local up --remove-orphans -d

In another topic relevant to this one (yet the other is for windows) I run the nslookup docker-images-prod.6aa30f8b08e16409b46e0173d6de2f56.r2.cloudflarestorage.com I get

Server:         127.0.0.53
Address:        127.0.0.53#53

Non-authoritative answer:
Name:   -docker-images-prod.6aa30f8b08e16409b46e0173d6de2f56.r2.cloudflarestorage.com
Address: 172.64.66.1
Name:   -docker-images-prod.6aa30f8b08e16409b46e0173d6de2f56.r2.cloudflarestorage.com
Address: 2606:4700:2ff9::1

But ping fails ping -n 1 docker-images-prod.6aa30f8b08e16409b46e0173d6de2f56.r2.cloudflarestorage.com

The whole OpenStack VM uses proxy server (docker has been successfully configured for that). I have created an account in Docker and logged in.

(Note that I had to edit a bit the o/ps so for this topic to be created (links limit problem))

Any ideas on what might be wrong?

2

It could be a firewall issue. Where are you trying to use Docker? At a company, on your own machine at home or in the cloud?

Your nslookup returns an IPv6 address aswell. What does your ping command returns? What IP does it try to use?

Or just use code blocks as you would on any technical forum, including GitHub issues. Use the </> button to start a code block or use MarkDown code blocks manually if you are using the MarkDown based message composer. More info here: How to format your forum posts

If you change the actual URL-s or domain names, it will be harder to notice the actual problems. Quotation marks are only for quoating already formatted messages. Thank you for trying :slight_smile:

3

If a http proxy is used, neither ping, nor nlsookup will provide any inside as of why the communication between the docker engine and the download url was interrupted. Can you access the http servers log? Or request them from the support team of your OpenStack provider.

On a 2nd look: the image names look odd. Are you running your own private container image registry and have problem pulling images from a private registry through a http proxy?

1 Like
4

I missed that part

I assume the reaso is this:

I just removed quotes and added code blocks instead

5

… and I missed the part with the edits.

Is it safe to assume that you did a docker login with your dockerhub account on the host?
While it might work to a certain extent in a private homelab environment, the pull limit will be exhausted quickly in an environment where multiple tenants use the same internet breakout.

Unauthenticated Users have a limit of 100 pulls per public IPv4 address or IPv6 /64 subnet in a 6 hrs window.
Even the personal account has 200 pulls individual to your account, regardless of the ip.

6

Hello rimelek
The Docker runs on a company’s OpenStack VM.

Hi meyay,
Yes this is the case. Specifically I am trying to install OpenEdX platform via Tutor through a http proxy.

Yes login succeeds with the free account after registration to docker. Yet I have tried to run docker run hello-worldonly for the system to respond with the same message as trying to run the Tutor installation:

~$ docker run hello-world
Unable to find image ‘hello-world:latest’ locally
latest: Pulling from library/hello-world
docker: failed to copy: httpReadSeeker: failed open: failed to do request: Get “https://docker-images-prod.6aa30f8b08e16409b46e0173d6de2f56.r2.cloudflarestorage.com/registry-v2/docker/registry/v2/blobs/sha256/1b/1b44b5a3e06a9aae883e7bf25e45c100be0bb81a0e01b32de604f3ac44711634/data?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=f1baa2dd9b876aeb89efebbfc9e5d5f4%2F20260119%2Fauto%2Fs3%2Faws4_request&X-Amz-Date=20260119T054226Z&X-Amz-Expires=1200&X-Amz-SignedHeaders=host&X-Amz-Signature=f0c1cfcd1726caf6db529d72efe0d92ddc5259cb2978da2521f0036515bcbc80”: Forbidden

I hope that helps.