Docker: 'push access denied, repository does not exist or may require authorization'

push access denied, repository does not exist or may require authorization: server message: insufficient_scope: authorization failed — Docker Hub refused the push because the first part of the image name is not an account you can write to. Log in with docker login, tag the image as <your-docker-id>/<repo>, and push that name.

Many answers quote this refusal as denied: requested access to the resource is denied. Docker Desktop 4.96 with its containerd image store printed the longer line above instead, so search for both.

The error

PS> docker tag alpine fix6example/hello:1
PS> docker push fix6example/hello:1
The push refers to repository [docker.io/fix6example/hello]
e2de96513ba9: Unavailable
push access denied, repository does not exist or may require authorization: server message: insufficient_scope: authorization failed

Exit code 1. The output went to a pipe, so the Unavailable line was printed again on every progress update, several dozen identical lines in all; they are shown once here.

Why it happens

The image name is the destination. With no registry host in front, Docker expands fix6example/hello to docker.io/fix6example/hello, which is exactly what the first line of the output says. On Docker Hub, the part before the slash is a namespace: a user or an organisation. You can push only into a namespace your login belongs to, and this push carried no login at all, so Docker Hub granted it no push rights; that is what insufficient_scope means.

The message offers two explanations, a repository that does not exist and one that needs authorization, because the registry does not tell an outsider which it is. The usual causes are a missing docker login, an image still tagged with a project name instead of your Docker ID, or a tutorial's example name copied as is.

The fix

This test did not sign in to Docker Hub, so the route is described here, not shown as a run: sign in with docker login, tag the image with docker tag under your own namespace, <your-docker-id>/hello:1, where the first part is your Docker ID or an organisation you belong to, and push that name. Then remove the wrong name. This part was run:

PS> docker rmi fix6example/hello:1
Untagged: fix6example/hello:1
PS> docker images --filter reference=fix6example/hello --filter reference=alpine
IMAGE           ID             DISK USAGE   CONTENT SIZE   EXTRA
alpine:latest   294b683cb724         13MB         3.94MB

A tag is another name for the same image, which is why both names had the ID 294b683cb724 before the clean-up. Removing the wrong name printed only Untagged, and alpine stayed. For other registries, the host goes at the front of the name: ghcr.io/<owner>/hello:1 for GitHub Container Registry after docker login ghcr.io, or <name>.azurecr.io/hello:1 for an Azure Container Registry after signing in to it.

How it was reproduced

Docker Desktop 4.96.3 with client and engine 29.9.2 and the containerd image store (docker info reports io.containerd.snapshotter.v1), from Windows PowerShell 5.1, using the cached alpine:latest image. The Docker CLI ran with an empty configuration folder (DOCKER_CONFIG), so no stored login could be sent, and the push was attempted once. fix6example is the test's own name, not an account of this site.

Frequently asked

What does 'push access denied, repository does not exist or may require authorization' mean?

Docker Hub refused the push. The namespace at the start of the image name is not one you can write to, usually because you are not logged in or the name does not start with your Docker ID.

How do I push an image to my own Docker Hub account?

Run docker login, tag the image as your-docker-id/repository:tag with docker tag, and push that name. The part before the slash must be your Docker ID or an organisation you can push to.

Does docker rmi on a tag delete the original image?

No. A tag is another name for the same image. Removing the extra tag printed only Untagged, and the original alpine image stayed with the same ID.

More decoded errors in the Fixes category. The same refusal on the way in, when Docker cannot pull an image: pull access denied, repository does not exist.