A 401 Unauthorized or 403 Forbidden almost always falls into one of these cases.
| Symptom | Likely cause | Fix |
|---|---|---|
| 401 on docker pull, no recent login | Expired or missing credentials | Run chainctl auth login, then chainctl auth configure-docker |
| auth status valid, but pull is 401 | Stale Docker credential | Run chainctl auth configure-docker |
| 403 on one specific image | Image not added to your org, or no entitlement | Confirm the image is in your organization catalog |
| 403 from Terraform or Helm, Docker works | Wrong audience or token scope | Authenticate the tool with the correct audience |
| "not entitled to <image>" | Plan does not include the image | Confirm entitlement or request access |
List the images your organization can pull:
chainctl images list --parent=<org-name-or-id>
Useful flags: --repo, --public, --active-only, -o table|json. See the chainctl images list reference for the full flag list.
Comments
0 comments
Article is closed for comments.