Can pull some models, but not others, apparently authorization issue

Docker's model pull command fails with an 'insufficient_scope: authorization failed' error because the command resolves against Docker Hub (docker.io) instead of Hugging Face, according to a technical analysis. The fix is to use the 'hf.co/' prefix in the pull command, as documented by Docker, to route the request to Hugging Face. The analysis also notes that the repository 'ecastera/eva-dolphin-llama3-8b-spanish' appears to be a PEFT/LoRA adapter artifact, which may present a separate compatibility issue.

Hmm… for now, the entry-point problem looks pretty simple, but there may still be another trap after that: The first thing I would try is this: docker model pull hf.co/ecastera/eva-dolphin-llama3-8b-spanish The reason is that the error you posted does not appear to be coming from Hugging Face at all . Your log says: resolving docker.io/ecastera/eva-dolphin-llama3-8b-spanish:latest ... insufficient scope: authorization failed So at that point Docker Model Runner is trying to resolve the name under Docker Hub docker.io , not under Hugging Face. Docker’s current docker model pull documentation https://docs.docker.com/reference/cli/docker/model/pull/ makes the source distinction explicit. For example: Docker Hub docker model pull ai/smollm2 Hugging Face docker model pull hf.co/bartowski/Llama-3.2-1B-Instruct-GGUF So I would treat hf.co/ here less as “the final fix” and more as the cheapest useful routing test : first make sure the request is actually going to the source you intended. That also explains why changing or recreating HF TOKEN would probably not help with the particular error in the post: the failing request shown in the log has not reached Hugging Face yet. HF TOKEN is still a real and relevant Hugging Face authentication mechanism https://huggingface.co/docs/huggingface hub/en/quick-start , so if the corrected command later reaches HF and gives an HF-side 401/403, then token/access becomes the right branch to investigate. A small decision tree might be: docker model pull hf.co/ecastera/eva-dolphin-llama3-8b-spanish | +-- pull succeeds | | | +-- run succeeds | | - probably done | | | +-- run/load fails | - now look at model format / backend / LoRA handling | +-- Hugging Face-side 401 / 403 | - now inspect HF TOKEN / gated or private access | +-- a different pull/import error - that new error identifies the next failing layer So even if the error changes , that is useful information rather than necessarily a failed fix. There is, however, a second reason I would not assume this specific model is finished once the hf.co/ issue is fixed: the current repository looks much more like a PEFT/LoRA adapter artifact than a self-contained 8B checkpoint . So, in short, I think there are probably two separate questions hiding here : php 1. Why is the command currently failing with "authorization"? - because the posted command is resolving against docker.io, not Hugging Face. 2. Will this particular HF repository run directly once routing is fixed? - maybe, but the current repo is a PEFT/LoRA adapter-shaped artifact, so that is a separate compatibility question. For the first one, the one-line test is: docker model pull hf.co/ecastera/eva-dolphin-llama3-8b-spanish If that changes the current docker.io/... insufficient scope error into something else, I would consider that progress: the new error should tell you which layer is actually next.