Cloudsmith Repository Authentication: Correct Username and Token Usage – DataHub Customer Support Portal

Area: Deployment Issues

Sub-Area: Remote Executor Image Pull / Cloudsmith Registry Authentication

Issue

When setting up or upgrading a DataHub Cloud Remote Executor, users must pull the executor Docker image from the DataHub Cloudsmith registry. This process is non-obvious because the required username format is not a standard account name or email address — it is a fixed repository path identifier. Users who attempt to authenticate with their organization name, personal username, or the word "token" as the username will fail to log in, even when supplying a valid entitlement token as the password.

Error Messages

Error response from daemon: pull access denied, repository does not exist or may require authentication
unauthorized: authentication required
Error: Cannot perform an interactive login from a non TTY device

You Might Be Asking

What username do I use to log in to the DataHub Cloudsmith Docker registry?
Why does docker login docker.datahub.com fail even though I have a valid entitlement token?
Is my entitlement token expired, or am I using the wrong credentials format?
How do I pull the datahub-executor image for deployment?
How long does a Cloudsmith entitlement token remain valid?

Solution

Obtain your entitlement token.
Contact DataHub Support to receive a Cloudsmith entitlement token. This token is provisioned per customer and delivered securely (e.g., via a one-time secret link). Save the token value in a secure location such as a secrets manager or vault — you will use it as the password in the steps below.
Authenticate against the DataHub Docker registry using the correct username.
The username is not your organization name, email address, or the word token. The correct username is the fixed repository path identifier re. Use your entitlement token as the password.
```
docker login docker.datahub.com
# When prompted:
# Username: re
# Password: <your-entitlement-token>
```
You can also pass credentials non-interactively:
```
echo "<your-entitlement-token>" | docker login docker.datahub.com \
  --username re \
  --password-stdin
```
Pull the Remote Executor image.
Replace <tag> with the version tag that corresponds to your DataHub Cloud instance version (e.g., v0.3.7). Your DataHub Support contact can confirm the correct tag.
```
docker pull docker.datahub.com/re/datahub-executor:<tag>
```
Cache the image in your own internal container registry.
To avoid Cloudsmith rate limits and to ensure reliable deployments — especially when running multiple pods or performing rolling upgrades — re-tag and push the image to your own private registry immediately after pulling:
```
# Re-tag the image for your internal registry
docker tag docker.datahub.com/re/datahub-executor:<tag> \
  <your-registry>/datahub-executor:<tag>

# Push to your internal registry
docker push <your-registry>/datahub-executor:<tag>
```
Update your Helm values or Kubernetes manifests to reference the image from your internal registry going forward.

Additional Notes

Username format is fixed: The Cloudsmith username for DataHub's remote executor repository is always re. This is a repository path segment, not a user account name. Using any other value (your org name, email, or token) will result in an authentication failure even with a valid token.
Token provisioning: Entitlement tokens are provisioned and managed by DataHub Support. If you have not received a token, or if your token appears to be expired or invalid, open a support ticket to request a new one. Tokens are intended to be long-lived; if you find yourself needing a new token frequently, confirm with Support that your token was correctly provisioned with a long expiry.
Rate limiting: Cloudsmith enforces pull rate limits. Caching the image in your own registry after the initial pull is strongly recommended for any environment that performs frequent or automated deployments.
Version matching: Always pull the image tag that matches the version of DataHub Cloud your instance is running. Mismatched versions between the remote executor image and the DataHub Cloud backend may cause unexpected behavior.
Registry URL: The DataHub Cloudsmith Docker registry hostname is docker.datahub.com. Ensure this host is reachable from the environment where you are performing the pull.

Issue

Error Messages

You Might Be Asking

Solution

Additional Notes

Related Documentation