Unable to pull image

[D0wn3r]

Before you start please confirm the following.

• [x] Yes, I've searched similar issues on GitHub.
• [x] Yes, I've checked whether this issue is covered in the Portainer documentation or knowledge base.

Problem Description

I had this bug before: some containers can’t start because the image is missing. When I try to pull the image manually from Portainer’s image interface, I get a forbidden error. I regenerated an access key from our GitLab, but it still doesn’t work with the new key — even though it works locally with docker login followed by docker pull (using the same key).

Expected Behavior

Be able to pull images manually with Image interface of Portainer but also have automatic image pulling if necessary

Actual Behavior

Go to Image interface of Portainer Try to pull image -> it doesn't work even with a fresh api_token (that work in a simple shell with docker login/pull)

Steps to Reproduce

Go to Image interface of portainer Try to pull image -> it doesn't work even with a fresh api_token (that work in a simple shell with docker login/pull)

Portainer logs or screenshots

No response

Portainer version

2.33.1

Portainer Edition

Community Edition (CE)

Platform and Version

Docker Swarm 27.1.2

OS and Architecture

Ubuntu 24.04

Browser

Firefox 143.0.1

What command did you use to deploy Portainer?

Additional Information

No response

[D0wn3r]

[D0wn3r]

in my stack, when I try to update with pull

[Nick-Portainer]

Hello @D0wn3r - Is this a selfhosted GitLab or the hosted version? Can you check the logs from Portainer and see if there's any reference there, as this seems like a permission error or you are not referencing the image correctly.

[D0wn3r]

It's selfhosted Gitlab but not problem to pull manually as I said.

I didn't see logs on portainer. It's not a permission error because I tried the same credential in local docker pull without problems

[D0wn3r]

Can I see more log if it happens again ? I use portainer with portainer-agents (docker-swarm)

[Nick-Portainer]

@D0wn3r Yes, you can open the browser dev console and open the network tab when you are attempting to reproduce this issue, the API call can provide details error logs.

[D0wn3r]

ok thank you. I keep this in mind

[D0wn3r]

@Nick-Portainer I put registry credential in portainer GUI and it doesn't work. I use the same credential in local with docker pull and it works.

[D0wn3r]

In network, I have a 500 on https://portainer.xxxxx/api/endpoints/1/docker/v1.41/images/create?fromImage=xxxxxxxxx:xxxxx {"message":"Head "https://xxxxxxxxxxxxxxx/manifests/prod": denied: access forbidden"}

Maybe it has a problem of synchronization when I change credential ?

[D0wn3r]

When I try to update a service (with pull image) in the "Stacks" part

[Nick-Portainer]

@D0wn3r - Can you join our Slack and we can chat there? https://join.slack.com/t/portainer/shared_invite/zt-21zpww5ab-mG_lA7UXbWL3HW3sPqjqEA

Just give me a ping in the Portainer-Help section