Docker image from project not accessible without explicit registry URL

Summary

When using gitlab.com specifying in .gitlab-ci.yml an image with image:tag does not fetch registry.gitlab.com/group/sub-group/project/image:tag.

Steps to reproduce

  1. We use two gitlab instances:
  • one self-hosted with gitlab-runner on which we deploy the docker images manually
  • gitlab.com with its runner.

  1. Create a docker image tagged image:tag (and deployed on our runner).

  2. Push this image to gitlab.com:

docker tag image:tag registry.gitlab.com/group/sub-group/project/image:tag
docker push registry.gitlab.com/group/sub-group/project/image:tag
  1. Use this image in CI (.gitlab-ci.yml):
test:
    image: image:tag
  1. push this commit on our instance and gitlab.com:
git push our-remote
git push gitlab.com
  1. See result:
  • build ok on our instance
  • build ko on gitlab.com

Example Project

https://gitlab.com/marcfinet_rtone/test-issue-docker-registry-gitlab.com

What is the current bug behavior?

Running with gitlab-runner 12.1.0 (de7731dd)
  on docker-auto-scale fa6cab46
Using Docker executor with image image:tag ...
Pulling docker image image:tag ...
ERROR: Job failed: Error response from daemon: pull access denied for image, repository does not exist or may require 'docker login' (executor_docker.go:192:0s)
Running with gitlab-runner 12.1.0 (de7731dd)
  on docker-auto-scale ed2dce3a
Using Docker executor with image registry.gitlab.com/marcfinet_rtone/test-issue-docker-registry-gitlab.com/image:tag ...
Authenticating with credentials from job payload (GitLab Registry)
Pulling docker image registry.gitlab.com/marcfinet_rtone/test-issue-docker-registry-gitlab.com/image:tag ...
Using docker image sha256:055936d3920576da37aa9bc460d70c5f212028bda1c08c0879aedf03d7a66ea1 for registry.gitlab.com/marcfinet_rtone/test-issue-docker-registry-gitlab.com/image:tag ...
Running on runner-ed2dce3a-project-13698867-concurrent-0 via runner-ed2dce3a-srm-1565191218-a31759fa...
Fetching changes with git depth set to 50...
Initialized empty Git repository in /builds/marcfinet_rtone/test-issue-docker-registry-gitlab.com/.git/
Created fresh repository.

From https://gitlab.com/marcfinet_rtone/test-issue-docker-registry-gitlab.com
 * [new branch]      use-explicit-registry -> origin/use-explicit-registry
Checking out 64ca366b as use-explicit-registry...


Skipping Git submodules setup

Authenticating with credentials from job payload (GitLab Registry)
$ echo "ok"

ok
Job succeeded

What is the expected correct behavior?

  • the job with implicit URL (i.e. with image:tag should work and use registry.gitlab.com/marcfinet_rtone/test-issue-docker-registry-gitlab.com/image:tag)

Relevant logs and/or screenshots

See jobs logs (links above)

Output of checks

This bug happens on GitLab.com