# Can pull some models, but not others, apparently authorization issue

> Source: <https://discuss.huggingface.co/t/can-pull-some-models-but-not-others-apparently-authorization-issue/178890#post_2>
> Published: 2026-08-19 22:32:01+00:00

Hmm… for now, the entry-point problem looks pretty simple, but there may still be another trap after that:

The first thing I would try is this:

```
docker model pull hf.co/ecastera/eva-dolphin-llama3-8b-spanish
```

The reason is that the error you posted does **not appear to be coming from Hugging Face at all**.

Your log says:

```
resolving docker.io/ecastera/eva-dolphin-llama3-8b-spanish:latest
...
insufficient_scope: authorization failed
```

So at that point Docker Model Runner is trying to resolve the name under **Docker Hub ( docker.io)**, not under Hugging Face.

Docker’s current [ docker model pull documentation](https://docs.docker.com/reference/cli/docker/model/pull/) makes the source distinction explicit. For example:

```
# Docker Hub
docker model pull ai/smollm2

# Hugging Face
docker model pull hf.co/bartowski/Llama-3.2-1B-Instruct-GGUF
```

So I would treat `hf.co/`

here less as “the final fix” and more as the **cheapest useful routing test**: first make sure the request is actually going to the source you intended.

That also explains why changing or recreating `HF_TOKEN`

would probably not help with the particular error in the post: the failing request shown in the log has not reached Hugging Face yet.

`HF_TOKEN`

is still a real and relevant [Hugging Face authentication mechanism](https://huggingface.co/docs/huggingface_hub/en/quick-start), so if the corrected command later reaches HF and gives an HF-side 401/403, *then* token/access becomes the right branch to investigate.

A small decision tree might be:

```
docker model pull hf.co/ecastera/eva-dolphin-llama3-8b-spanish
|
+-- pull succeeds
|      |
|      +-- run succeeds
|      |      -> probably done
|      |
|      +-- run/load fails
|             -> now look at model format / backend / LoRA handling
|
+-- Hugging Face-side 401 / 403
|      -> now inspect HF_TOKEN / gated or private access
|
+-- a different pull/import error
       -> that new error identifies the next failing layer
```

So even if the error *changes*, that is useful information rather than necessarily a failed fix.

There is, however, a second reason I would not assume this specific model is finished once the `hf.co/`

issue is fixed: the **current repository looks much more like a PEFT/LoRA adapter artifact than a self-contained 8B checkpoint**.

So, in short, I think there are probably **two separate questions hiding here**:

``` php
1. Why is the command currently failing with "authorization"?
   -> because the posted command is resolving against docker.io,
      not Hugging Face.

2. Will this particular HF repository run directly once routing is fixed?
   -> maybe, but the current repo is a PEFT/LoRA adapter-shaped artifact,
      so that is a separate compatibility question.
```

For the first one, the one-line test is:

```
docker model pull hf.co/ecastera/eva-dolphin-llama3-8b-spanish
```

If that changes the current `docker.io/... insufficient_scope`

error into something else, I would consider that progress: the new error should tell you which layer is actually next.