[Bug]: Pushing image to a private registry fails

[vsarunas]

I have done the following

• I have searched the existing issues
• If possible, I've reproduced the issue using the 'main' branch of this project

Steps to reproduce

I struggle with pushing to a registry.

Done via Screen Sharing login via Terminal.app, container installed from brew.

$ container r login harbor-registry.internal
Provide registry username harbor-registry.internal: admin
Provide registry password: 
Login succeeded

Then push fails with:

Error: error querying keychain for harbor-registry.internal (cause: "queryError("query failure: unhandledError(status: -25308)")")

There are no pop ups for password access.

Logs:

$ log stream --predicate 'subsystem == "com.apple.securityd"' --level debug
[...]
2026-03-13 08:02:56.301176+0200 0x27c0cb9  Default     0x433fcf6            36833  0    container-core-images: (Security) [com.apple.securityd:thread-local-client-debug] SecSecurityClientGet new thread!
2026-03-13 08:02:56.301315+0200 0x27c0cb9  Debug       0x433fcf6            36833  0    container-core-images: (Security) [com.apple.securityd:xpc] flagAlways:false inEduMode:false flagOld:false
2026-03-13 08:02:56.301339+0200 0x27c0cb9  Debug       0x433fcf6            36833  0    container-core-images: (Security) [com.apple.securityd:xpc] not using system keychain
2026-03-13 08:02:56.302272+0200 0x27c088f  Debug       0x433fcf6            42953  0    secd: [com.apple.securityd:serverxpc] XPC [container-core-i[36833]/1#-1 LF=0] operation: copy_matching (1)
[...]
2026-03-13 08:02:56.321444+0200 0x27bd978  Default     0x0                  162    0    securityd: [com.apple.securityd:clientid] code requirement check failed (-67050), client is not Apple-signed
2026-03-13 08:02:56.321461+0200 0x27bd978  Default     0x0                  162    0    securityd: [com.apple.securityd:SecurityAgentConnection] activate(0x16b8160a0)
2026-03-13 08:02:56.321518+0200 0x27bd978  Default     0x0                  162    0    securityd: (Security) [com.apple.securityd:security_exception] MacOS error: -25337
2026-03-13 08:02:56.321756+0200 0x27bd978  Debug       0x0                  162    0    securityd: (Security) [com.apple.securityd:security_exception] 0   Security                            0x00000001914ea8b8 Security::CommonError::LogBacktrace() + 124
2026-03-13 08:02:56.321776+0200 0x27bd978  Debug       0x0                  162    0    securityd: (Security) [com.apple.securityd:security_exception] 1   Security                            0x00000001914eae50 Security::MacOSError::MacOSError(int) + 312
2026-03-13 08:02:56.321788+0200 0x27bd978  Debug       0x0                  162    0    securityd: (Security) [com.apple.securityd:security_exception] 2   Security                            0x00000001914eaec0 Security::MacOSError::throwMe(int) + 40
2026-03-13 08:02:56.321798+0200 0x27bd978  Debug       0x0                  162    0    securityd: (Security) [com.apple.securityd:security_exception] 3   Security                            0x00000001914e8838 Security::makeCFArray(long, ...) + 0
2026-03-13 08:02:56.321806+0200 0x27bd978  Debug       0x0                  162    0    securityd: (Security) [com.apple.securityd:security_exception] 4   Security                            0x0000000191454ad4 cssmErrorString + 344
2026-03-13 08:02:56.321815+0200 0x27bd978  Debug       0x0                  162    0    securityd: (Security) [com.apple.securityd:security_exception] 5   securityd                           0x00000001047f3cb0 securityd + 441520
2026-03-13 08:02:56.321823+0200 0x27bd978  Debug       0x0                  162    0    securityd: (Security) [com.apple.securityd:security_exception] 6   securityd                           0x00000001047f3dc4 securityd + 441796
2026-03-13 08:02:56.321832+0200 0x27bd978  Debug       0x0                  162    0    securityd: (Security) [com.apple.securityd:security_exception] 7   securityd                           0x00000001047db0c8 securityd + 340168
2026-03-13 08:02:56.321841+0200 0x27bd978  Debug       0x0                  162    0    securityd: (Security) [com.apple.securityd:security_exception] 8   securityd                           0x00000001047dcce4 securityd + 347364
2026-03-13 08:02:56.321849+0200 0x27bd978  Debug       0x0                  162    0    securityd: (Security) [com.apple.securityd:security_exception] 9   securityd                           0x00000001047ddba8 securityd + 351144
2026-03-13 08:02:56.321857+0200 0x27bd978  Debug       0x0                  162    0    securityd: (Security) [com.apple.securityd:security_exception] 10  securityd                           0x00000001047ab904 securityd + 145668
2026-03-13 08:02:56.321866+0200 0x27bd978  Debug       0x0                  162    0    securityd: (Security) [com.apple.securityd:security_exception] 11  securityd                           0x00000001047aa7dc securityd + 141276
2026-03-13 08:02:56.321892+0200 0x27bd978  Debug       0x0                  162    0    securityd: (Security) [com.apple.securityd:security_exception] 12  securityd                           0x000000010479554c securityd + 54604
2026-03-13 08:02:56.321908+0200 0x27bd978  Debug       0x0                  162    0    securityd: (Security) [com.apple.securityd:security_exception] 13  securityd                           0x0000000104796f54 securityd + 61268
2026-03-13 08:02:56.321932+0200 0x27bd978  Debug       0x0                  162    0    securityd: (Security) [com.apple.securityd:security_exception] 14  securityd                           0x00000001047f1480 securityd + 431232
2026-03-13 08:02:56.321950+0200 0x27bd978  Debug       0x0                  162    0    securityd: (Security) [com.apple.securityd:security_exception] 15  securityd                           0x00000001047d2db4 securityd + 306612
2026-03-13 08:02:56.321980+0200 0x27bd978  Debug       0x0                  162    0    securityd: (Security) [com.apple.securityd:security_exception] 16  securityd                           0x00000001047cc948 securityd + 280904
2026-03-13 08:02:56.321997+0200 0x27bd978  Debug       0x0                  162    0    securityd: (Security) [com.apple.securityd:security_exception] 17  securityd                           0x00000001047e38c4 securityd + 374980
2026-03-13 08:02:56.322020+0200 0x27bd978  Debug       0x0                  162    0    securityd: (Security) [com.apple.securityd:security_exception] 18  securityd                           0x00000001047891d0 securityd + 4560
2026-03-13 08:02:56.322036+0200 0x27bd978  Debug       0x0                  162    0    securityd: (Security) [com.apple.securityd:security_exception] 19  securityd                           0x000000010478db0c securityd + 23308
2026-03-13 08:02:56.322060+0200 0x27bd978  Debug       0x0                  162    0    securityd: (Security) [com.apple.securityd:security_exception] 20  securityd                           0x00000001047e8b44 securityd + 396100
2026-03-13 08:02:56.322072+0200 0x27bd978  Debug       0x0                  162    0    securityd: (Security) [com.apple.securityd:security_exception] 21  securityd                           0x000000010478d208 securityd + 21000
2026-03-13 08:02:56.322101+0200 0x27bd978  Debug       0x0                  162    0    securityd: (Security) [com.apple.securityd:security_exception] 22  libsystem_pthread.dylib             0x000000018d8edc08 _pthread_start + 136
2026-03-13 08:02:56.322117+0200 0x27bd978  Debug       0x0                  162    0    securityd: (Security) [com.apple.securityd:security_exception] 23  libsystem_pthread.dylib             0x000000018d8e8ba8 thread_start + 8
2026-03-13 08:02:56.322174+0200 0x27bd978  Default     0x0                  162    0    securityd: [com.apple.securityd:security_exception] CSSM Exception: 224 unknown error 224=e0
2026-03-13 08:02:56.322215+0200 0x27bd978  Debug       0x0                  162    0    securityd: [com.apple.securityd:security_exception] 0   securityd                           0x00000001047e9440 securityd + 398400
2026-03-13 08:02:56.322223+0200 0x27bd978  Debug       0x0                  162    0    securityd: [com.apple.securityd:security_exception] 1   securityd                           0x00000001047f3d54 securityd + 441684
2026-03-13 08:02:56.322232+0200 0x27bd978  Debug       0x0                  162    0    securityd: [com.apple.securityd:security_exception] 2   securityd                           0x00000001047f3dc4 securityd + 441796
2026-03-13 08:02:56.322239+0200 0x27bd978  Debug       0x0                  162    0    securityd: [com.apple.securityd:security_exception] 3   securityd                           0x00000001047db0c8 securityd + 340168
2026-03-13 08:02:56.322247+0200 0x27bd978  Debug       0x0                  162    0    securityd: [com.apple.securityd:security_exception] 4   securityd                           0x00000001047dcce4 securityd + 347364
2026-03-13 08:02:56.322254+0200 0x27bd978  Debug       0x0                  162    0    securityd: [com.apple.securityd:security_exception] 5   securityd                           0x00000001047ddba8 securityd + 351144
2026-03-13 08:02:56.322280+0200 0x27bd978  Debug       0x0                  162    0    securityd: [com.apple.securityd:security_exception] 6   securityd                           0x00000001047ab904 securityd + 145668
2026-03-13 08:02:56.322295+0200 0x27bd978  Debug       0x0                  162    0    securityd: [com.apple.securityd:security_exception] 7   securityd                           0x00000001047aa7dc securityd + 141276
2026-03-13 08:02:56.322319+0200 0x27bd978  Debug       0x0                  162    0    securityd: [com.apple.securityd:security_exception] 8   securityd                           0x000000010479554c securityd + 54604
2026-03-13 08:02:56.322334+0200 0x27bd978  Debug       0x0                  162    0    securityd: [com.apple.securityd:security_exception] 9   securityd                           0x0000000104796f54 securityd + 61268
2026-03-13 08:02:56.322365+0200 0x27bd978  Debug       0x0                  162    0    securityd: [com.apple.securityd:security_exception] 10  securityd                           0x00000001047f1480 securityd + 431232
2026-03-13 08:02:56.322380+0200 0x27bd978  Debug       0x0                  162    0    securityd: [com.apple.securityd:security_exception] 11  securityd                           0x00000001047d2db4 securityd + 306612
2026-03-13 08:02:56.322404+0200 0x27bd978  Debug       0x0                  162    0    securityd: [com.apple.securityd:security_exception] 12  securityd                           0x00000001047cc948 securityd + 280904
2026-03-13 08:02:56.322418+0200 0x27bd978  Debug       0x0                  162    0    securityd: [com.apple.securityd:security_exception] 13  securityd                           0x00000001047e38c4 securityd + 374980
2026-03-13 08:02:56.322443+0200 0x27bd978  Debug       0x0                  162    0    securityd: [com.apple.securityd:security_exception] 14  securityd                           0x00000001047891d0 securityd + 4560
2026-03-13 08:02:56.322457+0200 0x27bd978  Debug       0x0                  162    0    securityd: [com.apple.securityd:security_exception] 15  securityd                           0x000000010478db0c securityd + 23308
2026-03-13 08:02:56.322486+0200 0x27bd978  Debug       0x0                  162    0    securityd: [com.apple.securityd:security_exception] 16  securityd                           0x00000001047e8b44 securityd + 396100
2026-03-13 08:02:56.322510+0200 0x27bd978  Debug       0x0                  162    0    securityd: [com.apple.securityd:security_exception] 17  securityd                           0x000000010478d208 securityd + 21000
2026-03-13 08:02:56.322526+0200 0x27bd978  Debug       0x0                  162    0    securityd: [com.apple.securityd:security_exception] 18  libsystem_pthread.dylib             0x000000018d8edc08 _pthread_start + 136
2026-03-13 08:02:56.322551+0200 0x27bd978  Debug       0x0                  162    0    securityd: [com.apple.securityd:security_exception] 19  libsystem_pthread.dylib             0x000000018d8e8ba8 thread_start + 8
2026-03-13 08:02:56.322620+0200 0x27bd978  Default     0x0                  162    0    securityd: [com.apple.securityd:SecurityAgentXPCQuery] SecurityAgentXPCQuery(0x16b8160a0) dying
2026-03-13 08:02:56.322629+0200 0x27bd978  Default     0x0                  162    0    securityd: [com.apple.securityd:SecurityAgentConnection] SecurityAgentConnection(0x16b8160a0) dying
2026-03-13 08:02:56.322675+0200 0x27bd978  Debug       0x0                  162    0    securityd: [com.apple.securityd:machserver] end request
2026-03-13 08:02:56.322884+0200 0x27c0cb9  Default     0x433fcf5            36833  0    container-core-images: (Security) [com.apple.securityd:security_exception] CSSM Exception: -2147415840 CSSMERR_CSP_NO_USER_INTERACTION

Similar to #816, except this is to push which sometimes works.

Current behavior

Failure to push the image to the registry.

Expected behavior

Succesful push to the registry.

Environment

- OS: 26.2 / 26.3
- Container: 0.10.0

Relevant log output

N/A

Code of Conduct

• I agree to follow this project's Code of Conduct

[vsarunas]

Full stack of container-core-images:

2026-03-13 08:02:56.325753+0200 0x27c0cb9  Debug       0x433fcf5            36833  0    container-core-images: (Security) [com.apple.securityd:security_exception] 0   Security                            0x00000001914ea8b8 Security::CommonError::LogBacktrace() + 124
2026-03-13 08:02:56.325803+0200 0x27c0cb9  Debug       0x433fcf5            36833  0    container-core-images: (Security) [com.apple.securityd:security_exception] 1   Security                            0x000000019139d788 Security::CssmError::CssmError(int, bool) + 356
2026-03-13 08:02:56.325819+0200 0x27c0cb9  Debug       0x433fcf5            36833  0    container-core-images: (Security) [com.apple.securityd:security_exception] 2   Security                            0x00000001911e8268 Security::CssmError::throwMe(int) + 44
2026-03-13 08:02:56.325849+0200 0x27c0cb9  Debug       0x433fcf5            36833  0    container-core-images: (Security) [com.apple.securityd:security_exception] 3   Security                            0x00000001914fc220 Security::SecurityServer::ClientSession::getAcl(Security::SecurityServer::AclKind, unsigned int, char const*, unsigned int&, Security::AclEntryInfo*&, Security::Allocator&) + 1240
2026-03-13 08:02:56.325864+0200 0x27c0cb9  Debug       0x433fcf5            36833  0    container-core-images: (Security) [com.apple.securityd:security_exception] 4   Security                            0x0000000191362e04 SSKey::getAcl(char const*, unsigned int&, Security::AclEntryInfo*&, Security::Allocator&) + 112
2026-03-13 08:02:56.325877+0200 0x27c0cb9  Debug       0x433fcf5            36833  0    container-core-images: (Security) [com.apple.securityd:security_exception] 5   Security                            0x000000019138b708 cssm_GetKeyAcl(long, cssm_key const*, char const (*) [68], unsigned int*, cssm_acl_entry_info**) + 232
2026-03-13 08:02:56.325888+0200 0x27c0cb9  Debug       0x433fcf5            36833  0    container-core-images: (Security) [com.apple.securityd:security_exception] 6   Security                            0x000000019141fc60 CSSM_GetKeyAcl + 188
2026-03-13 08:02:56.325900+0200 0x27c0cb9  Debug       0x433fcf5            36833  0    container-core-images: (Security) [com.apple.securityd:security_exception] 7   Security                            0x000000019138a0e4 Security::CssmClient::KeyImpl::getAcl(Security::AutoAclEntryInfoList&, char const*) const + 220
2026-03-13 08:02:56.325914+0200 0x27c0cb9  Debug       0x433fcf5            36833  0    container-core-images: (Security) [com.apple.securityd:security_exception] 8   Security                            0x0000000191444400 Security::KeychainCore::ItemImpl::checkIntegrityFromDictionary(Security::CssmClient::AclBearer&, Security::CssmClient::DbAttributes*) + 116
2026-03-13 08:02:56.325966+0200 0x27c0cb9  Debug       0x433fcf5            36833  0    container-core-images: (Security) [com.apple.securityd:security_exception] 9   Security                            0x0000000191445390 Security::KeychainCore::ItemImpl::checkIntegrity(Security::CssmClient::AclBearer&) + 72
2026-03-13 08:02:56.325982+0200 0x27c0cb9  Debug       0x433fcf5            36833  0    container-core-images: (Security) [com.apple.securityd:security_exception] 10  Security                            0x0000000191445250 Security::KeychainCore::ItemImpl::checkIntegrity() + 132
2026-03-13 08:02:56.326028+0200 0x27c0cb9  Debug       0x433fcf5            36833  0    container-core-images: (Security) [com.apple.securityd:security_exception] 11  Security                            0x00000001914413e0 Security::KeychainCore::ItemImpl::getContent(Security::CssmClient::DbAttributes*, Security::CssmDataContainer*) + 280
2026-03-13 08:02:56.326051+0200 0x27c0cb9  Debug       0x433fcf5            36833  0    container-core-images: (Security) [com.apple.securityd:security_exception] 12  Security                            0x0000000191446214 Security::KeychainCore::ItemImpl::getContent(SecItemClass*, SecKeychainAttributeList*, unsigned int*, void**) + 780
2026-03-13 08:02:56.326082+0200 0x27c0cb9  Debug       0x433fcf5            36833  0    container-core-images: (Security) [com.apple.securityd:security_exception] 13  Security                            0x000000019148d138 SecKeychainItemCopyContent + 296
2026-03-13 08:02:56.326106+0200 0x27c0cb9  Debug       0x433fcf5            36833  0    container-core-images: (Security) [com.apple.securityd:security_exception] 14  Security                            0x000000019146a3a8 AddItemResults(__SecKeychainItem*, __SecIdentity*, SecItemParams*, __CFAllocator const*, __CFArray**, void const**) + 572
2026-03-13 08:02:56.326143+0200 0x27c0cb9  Debug       0x433fcf5            36833  0    container-core-images: (Security) [com.apple.securityd:security_exception] 15  Security                            0x0000000191468cb4 SecItemCopyMatching_osx(__CFDictionary const*, void const**) + 2936
2026-03-13 08:02:56.326164+0200 0x27c0cb9  Debug       0x433fcf5            36833  0    container-core-images: (Security) [com.apple.securityd:security_exception] 16  Security                            0x000000019146b744 SecItemCopyMatching + 392
2026-03-13 08:02:56.326198+0200 0x27c0cb9  Debug       0x433fcf5            36833  0    container-core-images: (Security) [com.apple.securityd:security_exception] 17  container-core-images               0x0000000102754840 $s18ContainerizationOS13KeychainQueryV3get14securityDomain8hostnameAA0cD6ResultVSgSS_SStKF + 764
2026-03-13 08:02:56.326229+0200 0x27c0cb9  Debug       0x433fcf5            36833  0    container-core-images: (Security) [com.apple.securityd:security_exception] 18  container-core-images               0x00000001026f4fb8 $s19ContainerizationOCI14KeychainHelperV6lookup8hostnameAA14Authentication_pSS_tKF + 200
2026-03-13 08:02:56.326251+0200 0x27c0cb9  Debug       0x433fcf5            36833  0    container-core-images: (Security) [com.apple.securityd:security_exception] 19  container-core-images               0x00000001023d80b8 $s22ContainerImagesService0bC0C18withAuthentication33_A8651CEC11A6D2BF017AA0A5EF3FAF92LL3ref_xSgSS_AG19ContainerizationOCI0E0_pSgYaYbKctYaKlFZyt_Tg5TY0_ + 628
2026-03-13 08:02:56.326289+0200 0x27c0cb9  Debug       0x433fcf5            36833  0    container-core-images: (Security) [com.apple.securityd:security_exception] 20  libswift_Concurrency.dylib          0x00000002891d14d0 swift::runJobInEstablishedExecutorContext(swift::Job*) + 288

[jglogan]

@vsarunas Did you switch between the release page install and homebrew? I'm wondering if that's causing problems.

Perhaps you could go into keychain manager and delete your entries, and the try again with the homebrew stuff.

The release page installer has binaries that are signed and notarized through the normal WWDR mechanisms, whereas homebrew is an ad hoc build from source. Those look like two completely different apps to macOS so trying to use the same keychain for both probably will yield those -25xxx errors

[vsarunas]

@jglogan some machines did have a local build at some stage to test main branch; but they had only pulled public containers, shouldn't have pushed.

One of the hosts I did a macOS reboot and afterwards it did start to work...

Will try out the signed installer next time then.

[vsarunas]

It appears also brew had been using signed installer via Cask till Homebrew/homebrew-cask#228230

[jglogan]

@vsarunas OK, so I think that the workaround in these instances is either of:

• Using Keychain Manager, delete all keychain entries from the other app, and log in again with the new app.
• Restore a copy of the old app, log out from all registries, delete the old app and install the new app.

Per your previous comment, we're talking about two groups of apps:

• container as installed via the release page installer pkg, including pre-formula brew installs (around 0.6.0).
• Post-formula brew installs.

And "old app" and "new app" above refer to moving between these two groups.

[jglogan]

@p-linnane @adityaramani @katiewasnothere I'm interested in your take on this. The workaround will get folks unstuck but I feel we could do better. Users should be able move back and forth between homebrew and release page installs, as long as they are running one version at a time and subject to any version compatibility constraints. This problem prevents that.

We could define a compile time constant for the keychain ID similar to what we do for CVersion, and the Homebrew formulas could set this to something like org.homebrew.container.registry or dev.homebrew.container.registry.

Perhaps better, if we can wait say a month, is for the configuration system update, and then this could simply be a system configuration file parameter that the formula can tweak?

Either way, let's work out a plan and then I'll close this issue with the above workaround, and we can create a new issue for the proper fix.

[katiewasnothere]

@jglogan I like the idea of using the configuration system to set this.

[p-linnane]

@jglogan Happy to help however we can from the Homebrew side.