failed to solve: ubuntu/ubuntu:22.04: failed to authorize: failed to fetch oauth token: Post "<https://auth.docker.io/token>": dial tcp: lookup auth.docker.io on 8.8.8.8:53: read udp 172.28.207.184:54621->8.8.8.8:53: i/o timeout

{
  "mediaType": "application/vnd.oci.image.index.v1+json",
  "schemaVersion": 2,
  "manifests": [
    {
      "mediaType": "application/vnd.oci.image.manifest.v1+json",
      "digest": "sha256:819b2e9960f85e1667e924ebba1cd9e0bca7924a7afdaf5a194630bb2ed1e750",
      "size": 1800,
      "platform": {
        "architecture": "amd64",
        "os": "linux"
      }
    },
    {
      "mediaType": "application/vnd.oci.image.manifest.v1+json",
      "digest": "sha256:8de8b55a1b364eacb4b2b89e839f52120492a4c6c05110e982b3f3e9b663eb51",
      "size": 566,
      "annotations": {
        "vnd.docker.reference.digest": "sha256:819b2e9960f85e1667e924ebba1cd9e0bca7924a7afdaf5a194630bb2ed1e750",
        "vnd.docker.reference.type": "attestation-manifest"
      },
      "platform": {
        "architecture": "unknown",
        "os": "unknown"
      }
    }
  ]
}

# syntax = docker/dockerfile:1

# Make sure RUBY_VERSION matches the Ruby version in .ruby-version and Gemfile
ARG RUBY_VERSION=3.2.0
FROM ruby:$RUBY_VERSION-slim as base

LABEL fly_launch_runtime="rails"

# Rails app lives here
WORKDIR /rails

ARG RAILS_MASTER_KEY
# Set production environment
ENV RAILS_ENV="production" \
    BUNDLE_WITHOUT="development:test" \
    BUNDLE_DEPLOYMENT="1" \
    RAILS_MASTER_KEY=${RAILS_MASTER_KEY}

# Update gems and bundler
RUN gem update --system --no-document && \
    gem install -N bundler

# Install packages needed to install nodejs
RUN apt-get update -qq && \
    apt-get install --no-install-recommends -y curl && \
    rm -rf /var/lib/apt/lists /var/cache/apt/archives

# Install Node.js
ARG NODE_VERSION=14.21.1
ENV PATH=/usr/local/node/bin:$PATH
RUN curl -sL <https://github.com/nodenv/node-build/archive/master.tar.gz> | tar xz -C /tmp/ && \
    /tmp/node-build-master/bin/node-build "${NODE_VERSION}" /usr/local/node && \
    rm -rf /tmp/node-build-master


# Throw-away build stage to reduce size of final image
FROM base as build

# Install packages needed to build gems and node modules
RUN apt-get update -qq && \
    apt-get install --no-install-recommends -y build-essential git libpq-dev libvips node-gyp pkg-config python-is-python3

# Install yarn
ARG YARN_VERSION=1.22.19
# node modules are installed in root of the image
ENV NODE_ENV="production" \
    PREFIX=/usr/local \
    PATH=/usr/local/node/bin:$PATH
RUN npm install -g yarn@$YARN_VERSION && \
    rm -rf /usr/local/node/lib/node_modules/npm && \
    yarn --version && \
    apt-get remove -y node-gyp pkg-config && \
    apt-get autoremove -y && \
    rm -rf /tmp/npm* /tmp/gyp /tmp/node-* /tmp/node_modules/npm* /var/lib/apt/lists/* \
    /usr/local/node/lib/node_modules/npm

# Build options
ENV PATH="/usr/local/node/bin:$PATH"

# Install application gems
COPY --link Gemfile Gemfile.lock ./
RUN bundle install && \
    bundle exec bootsnap precompile --gemfile && \
    rm -rf ~/.bundle/ $BUNDLE_PATH/ruby/*/cache $BUNDLE_PATH/ruby/*/bundler/gems/*/.git

# Install node modules
COPY --link package.json yarn.lock ./
RUN yarn install --frozen-lockfile

# Copy application code
COPY --link . .

# Precompile bootsnap code for faster boot times
RUN bundle exec bootsnap precompile app/ lib/

# Precompiling assets for production without requiring secret RAILS_MASTER_KEY
RUN SECRET_KEY_BASE=DUMMY ./bin/rails assets:precompile


# Final stage for app image
FROM base

# Install packages needed for deployment
RUN apt-get update -qq && \
    apt-get install --no-install-recommends -y curl imagemagick libvips postgresql-client mtr iputils-ping && \
    rm -rf /var/lib/apt/lists /var/cache/apt/archives

# Copy built artifacts: gems, application
COPY --from=build /usr/local/bundle /usr/local/bundle
COPY --from=build /rails /rails

# Run and own only the runtime files as a non-root user for security
RUN useradd rails --create-home --shell /bin/bash && \
    chown -R rails:rails db log tmp
USER rails:rails

# Deployment options
ENV RAILS_LOG_TO_STDOUT="1" \
    RAILS_SERVE_STATIC_FILES="true"

# Entrypoint prepares the database.
ENTRYPOINT ["/rails/bin/docker-entrypoint"]

# Start the server by default, this can be overwritten at runtime
EXPOSE 3000

# See <https://docs.docker.com/engine/reference/builder/#dockerignore-file> for more about ignoring files.

# Ignore git directory.
/.git/

# Ignore bundler config.
/.bundle

# Ignore all default key files.
/config/master.key
/config/credentials/*.key

# Ignore all environment files.
/.env*
!/.env.example

# Ignore all logfiles and tempfiles.
/log/*
/tmp/*
!/log/.keep
!/tmp/.keep

# Ignore all cache files.
/tmp/cache/*

# Ignore pidfiles, but keep the directory.
/tmp/pids/*
!/tmp/pids/
!/tmp/pids/.keep

# Ignore storage (uploaded files in development and any SQLite databases).
/storage/*
!/storage/.keep
/tmp/storage/*
!/tmp/storage/
!/tmp/storage/.keep

# Ignore assets.
/node_modules/
/app/assets/builds/*
!/app/assets/builds/.keep
/public/assets

# Ignore data_files/
/data_files/*
!/data_files/.keep

# Ignore coverage
/coverage/*

# Ignore spec files
/spec/*
!/spec/.keep

$ docker login
Authenticating with existing credentials...
Login Succeeded
$ docker pull cloudposse/geodesic:latest-debian
Error response from daemon: Head "<https://registry-1.docker.io/v2/cloudposse/geodesic/manifests/latest-debian>": unknown: image access restricted: cloudposse/geodesic blocked for organization vznbi

 => [internal] load build definition from Dockerfile                                                                                                                  0.0s
 => => transferring dockerfile: 37B                                                                                                                                   0.0s
 => [internal] load .dockerignore                                                                                                                                     0.0s
 => => transferring context: 2B                                                                                                                                       0.0s
 => ERROR [internal] load metadata for <http://docker.io/cloudposse/geodesic:latest-debian|docker.io/cloudposse/geodesic:latest-debian>                                                                                    1.2s
 => [auth] cloudposse/geodesic:pull token for <http://registry-1.docker.io|registry-1.docker.io>                                                                                                    0.0s
------
 > [internal] load metadata for <http://docker.io/cloudposse/geodesic:latest-debian|docker.io/cloudposse/geodesic:latest-debian>:
------
failed to solve with frontend dockerfile.v0: failed to create LLB definition: failed to authorize: rpc error: code = Unknown desc = failed to fetch oauth token: unexpected status: 403 Forbidden
make[1]: *** [docker/build] Error 1
make: *** [build] Error 2

Containers: 16
 Running: 0
 Paused: 0
 Stopped: 16
Images: 113
Server Version: 18.09.7
Storage Driver: overlay2
 Backing Filesystem: extfs
 Supports d_type: true
 Native Overlay Diff: true
Logging Driver: json-file
Cgroup Driver: cgroupfs
Plugins:
 Volume: local
 Network: bridge host macvlan null overlay
 Log: awslogs fluentd gcplogs gelf journald json-file local logentries splunk syslog
Swarm: inactive
Runtimes: runc
Default Runtime: runc
Init Binary: docker-init
containerd version:
runc version: N/A
init version: v0.18.0 (expected: fec3683b971d9c3ef73f284f176672c44b448662)
Security Options:
 apparmor
 seccomp
  Profile: default
Kernel Version: 4.4.0-210-generic
Operating System: Ubuntu 16.04.7 LTS
OSType: linux
Architecture: x86_64
CPUs: 8
Total Memory: 23.55GiB
Name: prod-vm
ID: 7RPI:OM6S:O2M5:ONBV:QYEW:U47R:LUT2:JVOX:H6PE:SSBA:OUZR:SHE2
Docker Root Dir: /var/lib/docker
Debug Mode (client): false
Debug Mode (server): false
Registry: <https://index.docker.io/v1/>
Labels:
Experimental: false
Insecure Registries:
 <http://repo-jfrog.shay.com:8081|repo-jfrog.shay.com:8081>
 127.0.0.0/8
Live Restore Enabled: false

WARNING: API is accessible on <http://0.0.0.0:2375> without encryption.
         Access to the remote API is equivalent to root access on the host. Refer
         to the 'Docker daemon attack surface' section in the documentation for
         more information: <https://docs.docker.com/engine/security/security/#docker-daemon-attack-surface>
WARNING: No swap limit support

● docker.service - Docker Application Container Engine
   Loaded: loaded (/lib/systemd/system/docker.service; enabled; vendor preset: enabled)
  Drop-In: /etc/systemd/system/docker.service.d
           └─override.conf
   Active: active (running) since Wed 2022-06-01 17:58:27 IST; 1 day 1h ago
     Docs: <https://docs.docker.com>
 Main PID: 4663 (dockerd)
    Tasks: 24
   Memory: 85.7M
      CPU: 32.621s
   CGroup: /system.slice/docker.service
           └─4663 /usr/bin/dockerd

127.0.0.1   dev.local.test

# Install Docker CE
curl -fsSL <https://download.docker.com/linux/ubuntu/gpg> | apt-key add -
add-apt-repository \
   "deb [arch=amd64] <https://download.docker.com/linux/ubuntu> \
   $(lsb_release -cs) \
   stable"

apt-get update -yq && apt-get -yq install docker-ce docker-ce-cli <http://containerd.io|containerd.io>

$ route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         10.206.96.1     0.0.0.0         UG    100    0        0 ens5
10.206.96.0     0.0.0.0         255.255.224.0   U     0      0        0 ens5
10.206.96.1     0.0.0.0         255.255.255.255 UH    100    0        0 ens5
172.17.0.0      0.0.0.0         255.255.0.0     U     0      0        0 docker0
172.30.0.0      0.0.0.0         255.255.0.0     U     0      0        0 br-77455fcf0cbe
172.31.0.0      0.0.0.0         255.255.0.0     U     0      0        0 br-41e09bcc0b9c
192.168.32.0    0.0.0.0         255.255.240.0   U     0      0        0 br-c80695bea2be
192.168.96.0    0.0.0.0         255.255.240.0   U     0      0        0 br-5d6cf359313a
192.168.112.0   0.0.0.0         255.255.240.0   U     0      0        0 br-f38334a832ee
192.168.160.0   0.0.0.0         255.255.240.0   U     0      0        0 br-41a02bc22363
192.168.208.0   0.0.0.0         255.255.240.0   U     0      0        0 br-1f45ae76c3fe
192.168.224.0   0.0.0.0         255.255.240.0   U     0      0        0 br-8a8bb9ab22a0
192.168.240.0   0.0.0.0         255.255.240.0   U     0      0        0 br-c7f72974b999

# cat /etc/os-release
PRETTY_NAME="Debian GNU/Linux 10 (buster)"
NAME="Debian GNU/Linux"
VERSION_ID="10"
VERSION="10 (buster)"
VERSION_CODENAME=buster
ID=debian
HOME_URL="<https://www.debian.org/>"
SUPPORT_URL="<https://www.debian.org/support>"
BUG_REPORT_URL="<https://bugs.debian.org/>"
# %

aws ecr get-login-password --region us-east-1 | docker login --username AWS --password-stdin <http://XXXXXXXX.dkr.ecr.us-east-1.amazonaws.com|XXXXXXXX.dkr.ecr.us-east-1.amazonaws.com>

Login Succeeded

docker pull <http://XXXXXXXX.dkr.ecr.us-east-1.amazonaws.com/reponame|XXXXXXXX.dkr.ecr.us-east-1.amazonaws.com/reponame>
Using default tag: latest

Error response from daemon: pull access denied for <http://XXXXXXXX.dkr.ecr.us-east-1.amazonaws.com/reponame|XXXXXXXX.dkr.ecr.us-east-1.amazonaws.com/reponame>, repository does not exist or may require 'docker login': denied: User: arn:aws:sts::YYYYYYYY:assumed-role/AWSReservedSSO_AdministratorAccess_29495c17e6538e9b/myemail@example.com is not authorized to perform: ecr:BatchGetImage on resource: arn:aws:ecr:us-east-1:XXXXXXXX:repository/reponame

{
  "credsStore: "",
  "credHelpers": {
    "<http://123456789.dkr.ecr.us-east-1.amazonaws.com|123456789.dkr.ecr.us-east-1.amazonaws.com>": "ecr-login"
  }
}

aws ecr get-login-password --region us-east-1 | docker login --username AWS --password-stdin <http://123456789.dkr.ecr.us-east-1.amazonaws.com|123456789.dkr.ecr.us-east-1.amazonaws.com>