Open /etc/docker/certs.d/ghcr.io: permission denied

When building a multi-arch image, the CI job for inlets is pushing each individual image, but failing on the manifest push.

This does work on the Docker Hub, but seems to fail for GHCR:

docker manifest create --amend ghcr.io/inlets/inlets:2.7.5-2-g9d88c2b ghcr.io/inlets/inlets:2.7.5-2-g9d88c2b-amd64 ghcr.io/inlets/inlets:2.7.5-2-g9d88c2b-arm64 ghcr.io/inlets/inlets:2.7.5-2-g9d88c2b-armhf
open /etc/docker/certs.d/ghcr.io: permission denied
Makefile:61: recipe for target 'manifest-ghcr' failed

https://travis-ci.com/github/inlets/inlets/builds/182828844#L939

Sources:

https://github.com/inlets/inlets - see Makefile and .travis.yml (I can’t include the links, the forum won’t let me)

There was an old issue back in Moby with a similar error with Docker 18.x, so I’ve upgraded to the latest 19.x in Travis, and it still had no effect.

Are manifests supported with GHCR?

Here are two screenshots to show the differences between the Docker Hub and GHCR with regards to the manifests

The erroring example (again, I can’t upload two screenshots)

I’m using buildx in Actions and I’m not seeing this error. I’ll give it a try to use the same manifest create as you have here.

This worked for me on my machine… I’m not sure what’s going on with the error you’re seeing unless this is one of those things where the docker daemon needs to be restarted.

export Version=2.7.5
for Arch in arm64 amd64 armhf; do 
  docker pull inlets/inlets:${Version}-${Arch} 
  docker tag inlets/inlets:${Version}-${Arch} ghcr.io/$USER/inlets:${Version}-${Arch}
  docker push ghcr.io/$USER/inlets:${Version}-${Arch}
done

docker pull inlets/inlets:${Version}
docker tag inlets/inlets:${Version} ghcr.io/$USER/inlets:${Version}
docker push ghcr.io/$USER/inlets:${Version}


docker manifest create --amend ghcr.io/$USER/inlets:${Version} ghcr.io/$USER/inlets:${Version}-amd64 ghcr.io/$USER/inlets:${Version}-arm64 ghcr.io/$USER/inlets:${Version}-armhf

Created manifest list ghcr.io/clarkbw/inlets:2.7.5

Which created this:

docker --version
Docker version 19.03.12, build 48a66213fe

It seems like we both have the same version of Docker, however the Travis build fails on every build, without fail.

 Version:           19.03.12

I don’t know if I could push from my local machine (I probably can, given your output)

I wasn’t about to find much information on Google or the issue tracker on the error:

ghcr.io/inlets/inlets:2.7.5-2-g9d88c2b-armhf
open /etc/docker/certs.d/ghcr.io: permission denied
Makefile:61: recipe for target 'manifest-ghcr' failed
make: *** [manifest-ghcr] Error 1

The message about certs.d smells like Docker may not think that ghcr.io is a valid TLS certificate, and that it needs to dig up some self-signed cert.

I’m trying to isolate the issue here:

Seems related - https://github.com/docker/for-linux/issues/396

:man_facepalming: <- this wasn’t required for the Docker Hub.

1 Like