On stack deploy, unable to pin image to digest: unauthorized: the client does not have permission for manifest

Question

I'm running a Docker stack using a custom image which I have pushed to an Artifactory repository.

docker-compose.yml:

version: "3"

services:
  app:
    image: repo.example.com/my_image:latest

I can pull the image fine, and I can deploy the stack fine, but if I try to redeploy the stack, I get an error.

$ docker stack deploy --with-registry-auth -c docker-compose.yml my_stack
Creating network my_stack_default
Creating service my_stack_app

$ docker stack deploy --with-registry-auth -c docker-compose.yml my_stack
Updating service my_stack_app (id: 8po6oepjdgo8kwsb7n4ig64dt)
unable to pin image repo.example.com/my_image:latest to digest: unauthorized: The client does not have permission for manifest

I expect Docker to update the image when I redeploy the stack, just like it would if I used an image from Docker Hub.

I've seen Docker say unable to pin image before, but that was when I did not specify a repository (e.g. docker.io). I know I have permission from repo.example.com because I pushed the image there, I can still pull from it, and I can start the stack. I just can't update it.

What does this client does not have permission for manifest error mean, and how do I fix this issue?

Solution

The issue was we were using a specific old version of Docker Swarm (I think version 13) that had a bug that caused this error. We were limited to that version since RHEL7 at the time was limited to that version. Using Ubuntu and updating Docker to a more recent version solved it.

Comments

[jpyams]

Unfortunately, this doesn't work for me. I already have Delete/Overwrite permissions.

[jpyams]

Out of curiosity, why would not having Delete/Overwrite permissions cause issues?