We are getting some reports of 403 Forbidden errors when users attempt their first push to the data plane image registry using astro deploy. We have determined that this error has two possible causes: cached credentials which are no longer valid after an internal change in Astro to the image registry or use of containerd-snapshotter. The fixes must be performed client-side (i.e. on the machine running astro deploy).

Cached Credentials

If you are still experiencing this error, run docker logout for each Astro registry that this machine has cached credentials for. By default, the list of configured registries is stored in ~/.docker/config.json, and if you are using this default setting, the following bash script will identify cached credentials and run docker logout for those that correspond to Astro registries.
 

for domain in $(grep 'registry.astronomer.run' ~/.docker/config.json | awk '{print $1}' | tr -d '":' | sort | uniq); do
  docker logout "$domain"
done

Containerd-snapshotter

Use of containerd-snapshotter is not compatible with astro deploy. Recent versions of Docker Desktop default to turning this experimental feature on and it must be turned off to use astro deploy.

Option 1: Use Docker Desktop UI (Preferred)

1. Open Docker Desktop.
2. Go to Settings (or Preferences on Mac).
3. Navigate to Experimental features or Features in development.
4. Locate "Use containerd for pulling and storing images" (or similar) and toggle it off. (See Docker Documentation)
5. Click Apply & Restart to save the changes.

Option 2: Update daemon.json Configuration

1. Open the Docker daemon configuration file:
   Linux: /etc/docker/daemon.json
   Windows: C:\ProgramData\Docker\config\daemon.json
2. Add or update the following content:

   {"features": {"containerd-snapshotter": false} } 

   If the file already has other settings, simply add or update the "features" section.
3. Restart Docker.