act: m1: act fails to pull with unauthorized: incorrect username or password

Discussed in https://github.com/nektos/act/discussions/1165

<div type='discussions-op-text'>

Originally posted by ssbarnea May 15, 2022 I am on MacOS M1 and act failed to even pull the container reporting not being able to login to docker registry, but docker works correctly and it is able to pull.

$ act
WARN  ⚠ You are using Apple M1 chip and you have not specified container architecture, you might encounter issues while running act. If so, try running it with '--container-architecture linux/amd64'. ⚠
ERRO[0000] Unable to interpolate expression 'format('{0}', matrix.env.TOXENV)': Unable to dereference 'toxenv' on non-struct 'invalid'
ERRO[0000] 'runs-on' key not defined in push/ack
ERRO[0000] 'runs-on' key not defined in push/ack
[tox/lint-1     ] 🧪  Matrix: map[env:map[TOXENV:lint] os:ubuntu-20.04 python-version:3.9]
[tox/py-3       ] 🧪  Matrix: map[env:map[TOXENV:py] os:ubuntu-20.04 python-version:3.9]
[tox/packaging-2] 🧪  Matrix: map[env:map[TOXENV:packaging] os:ubuntu-20.04 python-version:3.9]
[tox/py-3       ] 🚀  Start image=node:16-buster-slim
[tox/packaging-2] 🚀  Start image=node:16-buster-slim
[tox/lint-1     ] 🚀  Start image=node:16-buster-slim
[tox/py-3       ]   🐳  docker pull image=node:16-buster-slim platform= username= forcePull=false
[tox/packaging-2]   🐳  docker pull image=node:16-buster-slim platform= username= forcePull=false
[tox/lint-1     ]   🐳  docker pull image=node:16-buster-slim platform= username= forcePull=false
Error: Error response from daemon: Head "https://registry-1.docker.io/v2/library/node/manifests/16-buster-slim": unauthorized: incorrect username or password
FAIL: 1

ssbarnea@m1: ~/c/schemastorepy main
$ docker pull node:16-buster-slim
16-buster-slim: Pulling from library/node
383d573fdcf2: Pull complete
a3942ef45b19: Pull complete
233507218b05: Pull complete
d14f918387bf: Pull complete
9f12e5ac2608: Pull complete
Digest: sha256:e5936cf8dbbb3c0d9d337c0e9f23e56e00b7e62280a8a617d12adfdda8ca9f11
Status: Downloaded newer image for node:16-buster-slim
docker.io/library/node:16-buster-slim

ssbarnea@m1: ~/c/schemastorepy main
$ docker --version
Docker version 20.10.14, build a224086
```</div>

About this issue

  • Original URL
  • State: open
  • Created 2 years ago
  • Reactions: 14
  • Comments: 19 (11 by maintainers)

Most upvoted comments

I am not using an m1, but I hit a similar error (even earlier in the process):

act "pull_request" \
		-s DOCKER_USERNAME \
		-s DOCKER_PASSWORD
[pr/build] 🚀  Start image=catthehacker/ubuntu:act-latest
[pr/build]   🐳  docker pull image=catthehacker/ubuntu:act-latest platform= username=*** forcePull=false
Error: Error response from daemon: Head "https://registry-1.docker.io/v2/catthehacker/ubuntu/manifests/act-latest": unauthorized: incorrect username or password
make: *** [test] Error 1

I briefly checked my rate-limit:

curl --head -H "Authorization: Bearer $TOKEN" https://registry-1.docker.io/v2/ratelimitpreview/test/manifests/latest 2>&1
HTTP/1.1 200 OK
content-length: 2782
content-type: application/vnd.docker.distribution.manifest.v1+prettyjws
docker-content-digest: sha256:767a3815c34823b355bed31760d5fa3daca0aec2ce15b217c9cd83229e0e2020
docker-distribution-api-version: registry/2.0
etag: "sha256:767a3815c34823b355bed31760d5fa3daca0aec2ce15b217c9cd83229e0e2020"
date: Sat, 21 May 2022 13:31:38 GMT
strict-transport-security: max-age=31536000
ratelimit-limit: 100;w=21600
ratelimit-remaining: 99;w=21600
docker-ratelimit-source: redacted

I can manually pull the image too:

❯ docker pull catthehacker/ubuntu:act-latest
act-latest: Pulling from catthehacker/ubuntu
d5fd17ec1767: Pull complete 
b802a9f71706: Pull complete 
da477514e5fd: Pull complete 
03f807692b16: Pull complete 
3940e38805ed: Pull complete 
4f4fb700ef54: Pull complete 
9b1c548cba3d: Pull complete 
4d0715de63c4: Pull complete 
Digest: sha256:93a6c9bb4e14a04c1b9f0faaf8f6ca7b3a30d268937f470aa45800b84b315820
Status: Downloaded newer image for catthehacker/ubuntu:act-latest
docker.io/catthehacker/ubuntu:act-latest

Once I pulled the image myself, act continues to work.

+1 on Ubuntu 22.04 on WSL2 using Docker Desktop 4.12.0 (85629), when trying to pull node:16-buster-slim with act. Works fine with docker pull node:16-buster-slim.

Unsuccessfully tried to pass secrets with:

  • The --secret-file flag
  • The --env-file flag
  • Hardcoding the values in the .yml file

The only way it worked was by directly passing the values with the -s flag:

act -s DOCKER_USERNAME=user -s DOCKER_PASSWORD=password

More information about my system is below:

Output of lsb_release -a command:

Distributor ID: Ubuntu
Description:    Ubuntu 22.04.1 LTS
Release:        22.04
Codename:       jammy

The output of the uname command:

Kernel name: Linux 
Kernel release: 5.15.57.1-microsoft-standard-WSL2 
Kernel version: #1 SMP Wed Jul 27 02:20:31 UTC 2022 
Machine: x86_64 
Processor: x86_64 
Hardware platform: x86_64 
OS: GNU/Linux

The output of the docker version command:

Client: Docker Engine - Community
 Cloud integration: v1.0.29
 Version:           20.10.17
 API version:       1.41
 Go version:        go1.17.11
 Git commit:        100c701
 Built:             Mon Jun  6 23:03:17 2022
 OS/Arch:           linux/amd64
 Context:           default
 Experimental:      true

Server: Docker Desktop
 Engine:
  Version:          20.10.17
  API version:      1.41 (minimum version 1.12)
  Go version:       go1.17.11
  Git commit:       a89b842
  Built:            Mon Jun  6 23:01:23 2022
  OS/Arch:          linux/amd64
  Experimental:     false
 containerd:
  Version:          1.6.8
  GitCommit:        9cd3357b7fd7218e4aec3eae239db1f68a5a6ec6
 runc:
  Version:          1.1.4
  GitCommit:        v1.1.4-0-g5fd4c4d
 docker-init:
  Version:          0.19.0
  GitCommit:        de40ad0

+1 on Windows as well. Using Docker Desktop 4.8.2 (79419)

Why can’t act just issue the “docker pull” command and delegate the responsibility to the already authenticated docker?

@sukkergris This is not your only problem,

This is your more relevant problem due to beeing on windows:

Error: failed to start container: Error response from daemon: network-scoped alias is supported only for containers in user defined networks

See here https://github.com/nektos/act/issues/2074

I would guess that the password act reads out of docker login in docker desktop is a placeholder instead of the actual password (which is stored in a credentials store) Act versions starting with v0.2.46 (1 June 2023 / https://github.com/nektos/act/pull/1774) should automatically try to pull without credentials, before failing to pull.

I’ll give it a shot. I did solve it by manually pulling the image and setting --pull=false in the .actrc though.