GitLab.com shared runners failing to pull images from quay.io/lib/* namespace with "Namespace lib has been disabled" error

Everyone can contribute. Help move this issue forward while earning points, leveling up and collecting rewards.

• Close this issue

Summary

GitLab.com shared runners are failing to pull Docker images from the quay.io/lib/* namespace with the error message "Namespace lib has been disabled. Please contact a system administrator." This appears to be a recent change affecting multiple projects and potentially self-hosted GitLab instances as well.

Environment

• GitLab version: GitLab.com (SaaS) version 18.4.0
• GitLab Runner version: 18.3.0~pre.23.gb8a899e1 (b8a899e1)
• Runner executor: docker+machine
• Runner host: green-2.saas-linux-small-amd64.runners-manager.gitlab.com

Steps to Reproduce

1. Create a CI job that uses image: quay.io/lib/python (or any image from the quay.io/lib/* namespace)
2. Run the pipeline on GitLab.com shared runners
3. Observe the failure during the "Preparing the docker+machine executor" phase

Expected Behavior

The runner should successfully pull the Docker image from quay.io/lib/python as it has in the past, and as it works when pulling the same image outside of GitLab's infrastructure.

Actual Behavior

The job fails with a "runner system failure" and the following error:

ERROR: Job failed: failed to pull image "quay.io/lib/python" with specified policies [always]: Error response from daemon: Head "https://quay.io/v2/lib/python/manifests/latest": denied: Namespace lib has been disabled. Please contact a system administrator.

Complete Job Log

See https://gitlab.com/gwpy/gwpy/-/jobs/11227618799

See also https://git.ligo.org/computing/gwdatafind/server/-/jobs/4257749 for a self-hosted instance of this failure.