authentication required to pull????? since when

[Modey2222]

I have searched the existing issues, both open and closed, to make sure this is not a duplicate report.

• Yes

The bug

hello everyone
lately i've been having issues pulling only immich
immich-server gets interrupted mid way
and immich-machine-learning Error Get "https://ghcr.io/v2/immich-app/immich-machine-learning/manifests/latest": dial tcp: lookup ghcr.io: no such host

when i paste this link in a browser to see whats going on this is what i see
{"errors":[{"code":"UNAUTHORIZED","message":"authentication required"}]}

The OS that Immich Server is running on

ubuntu - OMV

Version of Immich Server

All

Version of Immich Mobile App

All

Platform with the issue

• Server
• Web
• Mobile

Your docker-compose.yml content

#
# WARNING: To install Immich, follow our guide: https://immich.app/docs/install/docker-compose
#
# Make sure to use the docker-compose.yml of the current release:
#
# https://github.com/immich-app/immich/releases/latest/download/docker-compose.yml
#
# The compose file on main may not be compatible with the latest release.

name: immich

services:
  immich-server:
    container_name: immich_server
    image: ghcr.io/immich-app/immich-server:${IMMICH_VERSION:-release}
    # extends:
    #   file: hwaccel.transcoding.yml
    #   service: cpu # set to one of [nvenc, quicksync, rkmpp, vaapi, vaapi-wsl] for accelerated transcoding
    volumes:
      # Do not edit the next line. If you want to change the media storage location on your system, edit the value of UPLOAD_LOCATION in the .env file
      - ${UPLOAD_LOCATION}:/data
      - /etc/localtime:/etc/localtime:ro
    env_file:
      - .env
    ports:
      - '2283:2283'
    depends_on:
      - redis
      - database
    restart: always
    healthcheck:
      disable: false

  immich-machine-learning:
    container_name: immich_machine_learning
    # For hardware acceleration, add one of -[armnn, cuda, rocm, openvino, rknn] to the image tag.
    # Example tag: ${IMMICH_VERSION:-release}-cuda
    image: ghcr.io/immich-app/immich-machine-learning:${IMMICH_VERSION:-release}
    # extends: # uncomment this section for hardware acceleration - see https://immich.app/docs/features/ml-hardware-acceleration
    #   file: hwaccel.ml.yml
    #   service: cpu # set to one of [armnn, cuda, rocm, openvino, openvino-wsl, rknn] for accelerated inference - use the `-wsl` version for WSL2 where applicable
    volumes:
      - model-cache:/cache
    env_file:
      - .env
    restart: always
    healthcheck:
      disable: false

  redis:
    container_name: immich_redis
    image: docker.io/valkey/valkey:8-bookworm@sha256:facc1d2c3462975c34e10fccb167bfa92b0e0dbd992fc282c29a61c3243afb11
    healthcheck:
      test: redis-cli ping || exit 1
    restart: always

  database:
    container_name: immich_postgres
    image: ghcr.io/immich-app/postgres:14-vectorchord0.4.3-pgvectors0.2.0@sha256:32324a2f41df5de9efe1af166b7008c3f55646f8d0e00d9550c16c9822366b4a
    environment:
      POSTGRES_PASSWORD: ${DB_PASSWORD}
      POSTGRES_USER: ${DB_USERNAME}
      POSTGRES_DB: ${DB_DATABASE_NAME}
      POSTGRES_INITDB_ARGS: '--data-checksums'
      # Uncomment the DB_STORAGE_TYPE: 'HDD' var if your database isn't stored on SSDs
      # DB_STORAGE_TYPE: 'HDD'
    volumes:
      # Do not edit the next line. If you want to change the database storage location on your system, edit the value of DB_DATA_LOCATION in the .env file
      - ${DB_DATA_LOCATION}:/var/lib/postgresql/data
    shm_size: 128mb
    restart: always

volumes:
  model-cache:

Your .env content

# You can find documentation for all the supported env variables at https://immich.app/docs/install/environment-variables

# The location where your uploaded files are stored
UPLOAD_LOCATION=./library

# The location where your database files are stored. Network shares are not supported for the database
DB_DATA_LOCATION=./postgres

# To set a timezone, uncomment the next line and change Etc/UTC to a TZ identifier from this list: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones#List
# TZ=Etc/UTC

# The Immich version to use. You can pin this to a specific version like "v1.71.0"
IMMICH_VERSION=release

# Connection secret for postgres. You should change it to a random password
# Please use only the characters `A-Za-z0-9`, without special characters or spaces
DB_PASSWORD=postgres

# The values below this line do not need to be changed
###################################################################################
DB_USERNAME=postgres
DB_DATABASE_NAME=immich

Reproduction steps

1.compose.yaml
2.compose up
3.fails to pull
...

Relevant log output

Additional information

No response

[mmomjian]

You have a DNS issue: dial tcp: lookup ghcr.io: no such host

[Modey2222]

everything working i even updated every other docker image just fine only immich is doing this?
Also using cloudflare DNS

after a couple of compose up this also shows
immich-machine-learning Error manifest unknown
immich-server Interrupted
Error response from daemon: manifest unknown

[Modey2222]

kindly look into it i replaced the image to altran1502/immich-server and it pulled and working fine
it appears that immich is being blocked from my country Egypt for some reason or it is just a bug

[Modey2222]

i have narrowed it down to immich machine learning when un-commented from my compose
everything pulled and worked as expected this is the official compose from immich documentation
immich machine learning was the reason it was getting interrupted and canceling the whole docker operation

[slipperybeluga]

definitely something on your end. compose file looks fine to me. i pulled the image just to test and it works. it's coming from github so there is no downtime. and you can't directly access those urls in the browser i think.

if it's not already working by now, maybe just a reboot and flush your dns cache. can try doing a direct (non compose) pull to see if it's a compose issue

docker pull ghcr.io/immich-app/immich-server:${IMMICH_VERSION:-release}

[Modey2222]

i assure you it is from immich it self
just now i replaced the image from official immich repository to altran1502/immich-server from docker hub and it pulled and working fine only official immich is doing this for me
altran1502/immich-server works and every other docker service pulls and works just fine

[skatsubo]

Try to pull the image using another tool instead of the official docker client and see if it is different.

Example from #19719 (reply in thread):

• skopeo --debug --command-timeout 10m copy --retry-times 5 docker://ghcr.io/immich-app/immich-server:release docker-daemon:immich-server:release

Also, as mentioned above: "you can't directly access those urls in the browser".

[Modey2222]

as i mentioned above to mmomjian i narrowed it down to immich machine learning this was the cause for the restart and interruption after un-commenting maching learning it pulled immich-server
but when i changed the image for immich machine learning to one of altran1502 it pulled immich machine learning from his repo but not the official one it seems that any thing with AI is being limited to some countries only or maybe it is just a bug

[joshuacurtiss]

Hello all. What if you logout of ghcr.io so that it is truly anonymous, is it still working for you?

I experienced the same problem as OP, and once I logged into ghcr.io, I could then pull the image. Had to login to ghcr.io on my server.

root@myserver:/proj/immich# docker pull ghcr.io/immich-app/immich-server:release
Error response from daemon: Head "https://ghcr.io/v2/immich-app/immich-server/manifests/release": denied: denied
root@myserver:/proj/immich# docker login ghcr.io
Authenticating with existing credentials... [Username: myusername]

i Info → To login with a different account, run 'docker logout' followed by 'docker login'


Login did not succeed, error: Error response from daemon: Get "https://ghcr.io/v2/": denied: denied
Username (myusername): 
Password: 

WARNING! Your credentials are stored unencrypted in '/root/.docker/config.json'.
Configure a credential helper to remove this warning. See
https://docs.docker.com/go/credential-store/

Login Succeeded
root@myserver:/proj/immich# docker pull ghcr.io/immich-app/immich-server:release
release: Pulling from immich-app/immich-server
59e22667830b: Already exists 
dbe5016d5605: Pull complete 
013b1f6b2fa0: Pull complete 
c222336d941a: Pull complete 
372c13f59098: Pull complete 
a6fbc9356587: Pull complete 
c66fae11a1ce: Pull complete 
18ac97efa62a: Pull complete 
47de7e929174: Pull complete 
f24dc1de6050: Pull complete 
54e718c71c05: Pull complete 
63768515042b: Pull complete 
4f4fb700ef54: Pull complete 
103b957e67fb: Pull complete 
f8b7404ae5fe: Pull complete 
6bd81b15ac67: Pull complete 
b28486c39562: Pull complete 
82bd792c9571: Pull complete 
ba164a50de50: Pull complete 
2bef8e5db55a: Pull complete 
7045d211a578: Pull complete 
0c9043e5f70e: Pull complete 
Digest: sha256:12cee930e2cc211a95acae12ad780c0b2eecaea0479a06e255c73a4deb0b3efb
Status: Downloaded newer image for ghcr.io/immich-app/immich-server:release
ghcr.io/immich-app/immich-server:release

[skatsubo]

Does this happen to you from a fresh docker / VM / host as well?

Thinking if this could be ghcr-specific config/leftovers/tokens on your current machine, like described here https://github.com/orgs/community/discussions/50487.

[joshuacurtiss]

Ah, very nice, you're right! Didn't even cross my mind that a stale token could be causing it. It indeed works on a fresh OS install, tested with Ubuntu24/Docker. So it had to have been a stale ghcr.io token.

Thanks!!

p.s. I'm currently evaluating this project for my family's use and I have to say it is well done. Kudos to you all.