Docker pull: 'manifest unknown' or 'pull access denied for X, repository does not exist or may require 'docker login'' - what causes it and how do I fix it?

Cause: these two messages come from the registry and usually mean the exact name you asked for can't be served to you. Common reasons: a typo in the repository name or namespace; a tag that doesn't exist for that image (manifest unknown); a private repository you aren't logged in for (Docker Hub deliberately describes missing and not-permitted repositories the same way, as 'may require docker login'); a registry host missing from the name; or a tag/platform combination that isn't published. Omitting a tag means latest, which not every repository publishes. Fix (best first): 1. Check the spelling and the full reference: [registry-host/]namespace/name:tag. Official Docker Hub images have no namespace (nginx), others do (someorg/tool). Look the repository and its tags up on the registry's web page. 2. Use a tag that exists rather than relying on latest, or pin by digest (name@sha256:...) once you know it. 3. For private images, authenticate: docker login (for Docker Hub it uses a browser device-code flow by default) or docker login registry.example.com. In scripts use a personal or organization access token with --password-stdin so the secret doesn't land in shell history. Make sure the account actually has pull permission on that repository. 4. If the image exists but not for your CPU architecture, see the separate platform mismatch error; --platform selects a variant when the image is multi-platform. 5. If pulls work in a browser but fail from the daemon, check proxy settings for the daemon and credential helper configuration in ~/.docker/config.json. Verify: docker pull name:tag succeeds, or docker login reports Login Succeeded and the same pull then works. Sources: https://docs.docker.com/reference/cli/docker/image/pull/ https://docs.docker.com/reference/cli/docker/login/ https://docs.docker.com/docker-hub/repos/access/