How pull a docker image in a private organisation with Forgejo repository

[Eliophot]

Hello,

On Dokploy, I add my Forgejo instance in Registry, I test connection, it's ok.
I use docker compose to pull my docker image, it's ok when the organisation is public.
But when my organisation is private, I have this issue :

Image git.myforgejo.fr/myorganisation/myrepo:dev Error unauthorized: reqPackageAccess
Error response from daemon: unauthorized: reqPackageAccess
Error: ❌ Docker command failed
Error occurred ❌, check the logs for details.

But I did create a linked user with the appropriate permissions and PAT
What did I miss?

Thanks

[dosubot[bot]]

Hi @Eliophot! I'm Dosu and I’m helping the dokploy team.

This is a known issue with how Dokploy handles registry authentication for Docker Compose deployments. The "Test Connection" button runs docker login on the Dokploy control server, but the credentials may not be available where the actual deployment happens [1].

A few things to check and try:

1. Verify credentials exist on the deployment target — SSH into the server where the compose service is actually deployed and check:

   cat /root/.docker/config.json

   Your Forgejo registry URL should appear in the auths section. If it's missing, manually log in on that server:

   docker login git.myforgejo.dev -u <username> -p <PAT>

2. Set DOCKER_CONFIG in your application's environment variables — In the Dokploy Environment tab for your application, add:

   DOCKER_CONFIG=/root/.docker
   

   This ensures Docker Compose knows where to find the stored credentials [2].

3. Use an organization-level token — For Forgejo private organizations, make sure your PAT (or deploy token) has package read permissions at the organization level, not just at the repository level. The reqPackageAccess error specifically indicates the token lacks the required package/container registry scope for that organization [3].

The most likely culprit here is #3 — your PAT may have repository-level permissions but not the organization-level package access that Forgejo requires for private org registries. In Forgejo, you typically need the read:package scope on the token, and the user associated with the token needs to be a member of the private organization with sufficient access.

To reply, just mention @dosu.

---

Share context across your team and agents. Try Dosu.