Fix Private Registry "Pull Access Denied" on Coolify

Error: Error response from daemon: pull access denied / unauthorized: authentication required

Docker refuses to pull your image because the Coolify server was never authenticated to the private registry it's hosted on, so the deploy fails before the container can start.

Coolify doesn't manage credentials for arbitrary private registries through its own UI — it relies entirely on the Docker daemon's own credential store on the host (/root/.docker/config.json). If the server was never docker login-ed to that specific registry, or the stored credentials don't resolve for the path Coolify uses to pull, every deploy referencing that image fails at the Docker daemon level, before any of Coolify's own settings are even consulted. This shows up the same way for Docker Hub, GHCR, GCR, and self-hosted registries.

The fix

  1. SSH into the server and log in to the registry directly, or re-save credentials under Coolify's Server > Docker Registry settings to regenerate the daemon's config file.

    docker login <registry-host>

  2. Confirm the login actually works by pulling the image manually as the same user Coolify runs under.

    docker pull <private-image>

  3. For self-hosted registries, confirm htpasswd-based auth is set correctly and the registry has been restarted since the credentials were added.

  4. If you're running Docker Swarm, confirm the registry is reachable from every node, not just the leader — a pull that works on one node can still fail on another.

Verify it worked

The manual docker pull succeeds on the host, and a redeploy completes without a pull access denied or unauthorized error.

docker pull <private-image>

Related Coolify errors

Sources

Have Emsden Studio fix it for you — from A$149

All Coolify deploy errors