Using Repository Access Tokens to pull Docker Images from the Bitbucket packages registry externally

[Marc]

Hello,

I have a Bitbucket Pipeline in my repository that successfully builds a Docker image and pushes it to the Bitbucket Container Registry.

I can pull the image from my laptop using a Personal API Token with the read:package:bitbucket scope, so the registry itself is working correctly. However, I would prefer not to use my personal token for this use case.

To avoid that, I created a Repository Access Token. The available scopes only seem to include read:repository (I could not find any package/container registry related scope), but authentication always fails when I try to pull the image using this token.

I also tried authenticating with both:

x-token-auth

<repo-uuid>@bots.bitbucket.org

for docker login, based on what I read in here, but I still receive authorization errors.

Am I missing a required scope or configuration for pulling images from the Bitbucket Container Registry using Repository Access Tokens?

Thanks.

[Ajay _view26_ · Accepted solution]

Hi @Marc 

Repository Access Tokens don't currently support the container registry — that's the root cause here.

The Bitbucket Packages registry requires the read:package:bitbucket scope, which is only available on Atlassian API tokens (user-level tokens), not Repository Access Tokens. The repo-level tokens are scoped to repository operations only, so regardless of the username format you use (x-token-auth or the bot UUID), the auth will fail at the registry layer.

[Marc]

Hi @Ajay _view26_ ,

Thank you for the clarification. Are there any plans to make this scope available for Repository Access Tokens or other non-user tokens in the future?

Thanks.

[timothywittman]

@Ajay _view26_,

My team has also run into this problem today. We have successfully leveraged user-level tokens, however we prefer not to have user level tokens for all pipelines throughout our workspace. We have a large org, so to tie a single user token to all our bitbucket package reads seem like an incomplete feature.

Is there any plan to give Workspace Access Tokens the ability to include scopes related to *:package:bitbucket?

Thanks.