Google cloud registry authentication for pushing images

[Jeroen Benckhuijsen]

Hi,

As per https://support.atlassian.com/bitbucket-cloud/docs/use-docker-images-as-build-environments/#Private-images-hosted-by-Google-Container-Registry--GCR- I've configured my build to use a custom image to build my application. So basically, I've included this in my build:

image:
  name: [region].gcr.io/<project>/image:latest
  username: _json_key
  password: '$GCR_JSON_KEY'

The image is pulled correctly and the build runs.

As part of that pipeline, a resulting image is pushed to the same registry as the build image was pulled from. I.e.

docker push <region>.gcr.io/[project]/application-image:$BITBUCKET_COMMIT

I would've expected that the authentication to that host is reused from pulling the image, but that's not the case. Docker indicates that the request as unauthenticated.

Is this not possible, is this just a setting I'm missing? I can obviously work around this by redoing the auth, but seems a bit duplicate.

tnx

[Ayla · Accepted solution]

Hi Jeroen,

Thanks for sharing your setup! What you're experiencing is a common scenario. Unfortunately, Docker does not automatically reuse authentication tokens between docker pull and docker push commands in pipelines, even if they target the same registry.

So while your image pulls correctly using the credentials you provided, the push step requires its own explicit authentication. This isn’t specific to Bitbucket pipelines or GCR — it’s just how Docker’s auth works.

You’ll need to explicitly authenticate before pushing the image, for example by running:

bash
Copy
Edit
echo $GCR_JSON_KEY | docker login -u _json_key --password-stdin https://[region].gcr.io
before your push command. This extra login step is necessary to ensure your push request is properly authenticated.

Hope this helps clarify things!