Authentication Issues with GHCR for NS8 Image (Even with Valid Token)

Development
1

Dear NethServer Team,

I’m trying to properly authenticate with GHCR to use the NethServer Docker images in our CI/CD pipeline, but despite following the recommended steps, I keep getting DENIED: invalid token errors. Here’s what I’ve tried:

  1. Token Configuration:
  • Created new GitHub tokens with:
    • Only read:packages scope
    • Tried adding repo scope (for private repos)
  • Verified token length (40 chars) and no trailing spaces
  1. Test Commands:

# Returns DENIED error curl -H "Authorization: token ghp_***" https://ghcr.io/v2/nethserver/ns8/tags/list

# Docker login succeeds but pull fails echo "$GHCR_TOKEN" | docker login ghcr.io -u USER --password-stdin docker pull ghcr.io/nethserver/ns8:8.4 # manifest unknown

Key Questions:

  • Is the nethserver/ns8 image repository private? If so, what are the access requirements?
  • Are there special organization-level permissions needed?
  • Could you share a working example of CI/CD authentication?

… the context

I’m creating the documentation for a project approved by “El Sistema” for the presentation “Orchestrating the Educational Experience: Asset Management | Audiovisual Archive” where we used NethServer + Proxmox-VE as our fundamental node. I want to finish the documentation to share it with those who will help me implement it. Of course, I want to share it with this community, with much gratitude.

Happy times, everyone.

1 Like
2

Hello Adrian,
thanks for sharing NS8!

Of course not! :wink:
All ns8 images are public including the repository that contains the code of the image.

Nope: you can pull the image without authentication.

I think the problem is that there is no image named ghcr.io/nethserver/ns8:8.4.
The version 8.4 is just a milestone name for a bunch of containers.

The core includes many containers like core, ldapproxy and many other.

To pull the only main core image, just execute:

docker pull ghcr.io/nethserver/core:3.9.0

Inside the testing CI, the requests are not authenticated.
The CI authenticates itself only when pushing new images.
This a workflow using Github CLI, but you do not need it for download:

export CR_PAT=$(gh auth token)
echo  $CR_PAT | podman login ghcr.io -u gsanchietti --password-stdin
podman pull ghcr.io/nethserver/ns8:8.4

If you want to know more, take a look to the install script.

4 Likes
3

pipeline-Giacomo
pipeline-Giacomo990×208 14.7 KB

What can I say, my friend?

Thank you very much!
I’ll share the publication soon.

All the best to you, Giacomo.

4 Likes
4

hello sir, any feedback in this, just came accross this, might be useful with module build automation testing.