GHCR push returns "denied" after all blobs upload — image manifest and tag missing #211735
Replies: 2 comments 1 reply
|
💬 Your Product Feedback Has Been Submitted 🎉 Thank you for taking the time to share your insights with us! Your feedback is invaluable as we build a better GitHub experience for all our users. Here's what you can expect moving forward ⏩
Where to look to see what's shipping 👀
What you can do in the meantime 💻
As a member of the GitHub community, your participation is essential. While we can't promise that every suggestion will be implemented, we want to emphasize that your feedback is instrumental in guiding our decisions and priorities. Thank you once again for your contribution to making GitHub even better! We're grateful for your ongoing support and collaboration in shaping the future of our platform. ⭐ |
|
I can't tell the cause from the outside, but I can answer your last two questions, and the debug log below should show you the cause. No incident covers your push. The githubstatus.com history lists one incident on October 29, a Copilot Cloud disruption from 10:19 to 12:49 UTC, and nothing for Packages around 20:29 UTC. Retrying the same archive is safe, and you don't need to clean anything up first. A registry stores blobs by digest, and an image or tag exists only after its manifest PUT succeeds. The client pushes the manifest last, so the denied request left blobs that no manifest references. That matches what you see: 13 blobs present and a tag that returns 404. When you push the same archive again, the client checks each blob by digest, skips the ones GHCR already has, and retries only the manifest and index PUTs. The digests don't change, so nothing conflicts. To see the rejected request, push with a client that logs HTTP. skopeo can push your OCI archive as it is: The debug log prints each request, so you'll see which PUT GHCR rejected (the amd64 manifest, the attestation manifest, or the index) and the full error body it sent back. Docker condenses that response to one line, which is why you only saw One per-package setting is worth comparing with the package that worked. If the push ran in GitHub Actions with Sources:
|
|
Thanks for your detailed explanation! The issue has now been resolved. We successfully completed the publication by uploading the missing OCI manifests and index without rebuilding the image or deleting the existing blobs. Both manifest PUT requests returned HTTP 201, and the final registry readback verified the complete image. The original cause of the denied response remains unknown, but the image is now published and verified. Thanks again for your help! |
Uh oh!
There was an error while loading. Please reload this page.
🏷️ Discussion Type
Bug
Body
Hello GitHub Community,
I’m experiencing an unexpected issue while publishing a Docker OCI image to GitHub Container Registry (GHCR).
What happened
On October 29, 2026, at approximately 20:29:36–20:29:43 UTC, a Docker push to a private GHCR package failed with:
denied
Docker exited with code 1.
The image was previously built and validated locally for linux/amd64.
What we verified
Unfortunately, the original Docker output did not capture the exact rejected HTTP request or its response status.
Questions
I would prefer to avoid rebuilding the image or deleting the partially uploaded content without understanding the cause.
Any suggestions would be appreciated. Thank you!
All reactions