Gitlab-CI - Runner can't pull docker image - authorization token required

Question

I am using Omnibus Gitlab version 10.7.3-ee . I pushed a docker image on my own registry with a personal access token with success. But when I want to build from this image in the Gitlab CI pipeline, I got the following error in the gitlab interface :

Running with gitlab-runner 10.6.0 (xxxxxxx)
on my-runner xxxxxxx
Using Docker executor with image gitlab.example.com/myproject/myimage1 ...
Pulling docker image gitlab.example.com/myproject/myimage1 ...
ERROR: Preparation failed: Error: No such image: gitlab.example.com/myproject/myimage1
Will be retried in 3s ...

On the gitlab server side, I got in /var/log/gitlab/registry/current :

level=warning msg="error authorizing context: authorization token required"

At the same time in /var/log/gitlab/gitlab-rails/production.log :

Processing by Gitlab::RequestForgeryProtection::Controller#index as */*
  Parameters: {"changes"=>"_any", "gl_repository"=>nil, "project"=>"myproject/project.git", "protocol"=>"ssh", "env"=>"{}", "key_id"=>"[FILTERED]", "secret_token"=>"[FILTERED]"}
Can't verify CSRF token authenticity
This CSRF token verification failure is handled internally by `GitLab::RequestForgeryProtection`
Unlike the logs may suggest, this does not result in an actual 422 response to the user
For API requests, the only effect is that `current_user` will be `nil` for the duration of the request
Completed 422 Unprocessable Entity in 0ms (ActiveRecord: 0.0ms | Elasticsearch: 0.0ms)

What is happening here? Thanks for your help.

Answer 1

I finally solved my own issue. I don't why I have suddenly been asked for credentials whereas I did not need it.

Using DOCKER_AUTH_CONFIG variable did nothing to help me.

The solution was to log in from my private runner. Then it was able to pull the image.

docker login private-runner.example.com -u John -p mypassword

Then I pulled and logged out.

I don't know if it is a solution or a workaround... but later, I totally reinstalled my runner and I succeeded to pull without been log in...