title: 403 Forbidden when downloading a container image from the registry outside GCE
body: <p>I am trying to download an image from the Google container registry in a CoreOS machine running in other server (not GCE).</p>
  
  <p>I configured a new service account:</p>
  
  <pre><code>core@XXXX ~ $ docker run -t -i -v $(pwd)/keys:/tmp/keys --name gcloud-config ernestoalejo/google-cloud-sdk-with-docker gcloud auth activate-service-account XXXXXXX@developer.gserviceaccount.com --key-file /tmp/keys/key.p12 --project XXXX
  Activated service account credentials for: [XXXXXXX@developer.gserviceaccount.com]
  </code></pre>
  
  <p>The account is active, but when I try to download the container image it returns a forbidden HTTP status.</p>
  
  <pre><code>core@XXXX ~ $ /usr/bin/docker run --volumes-from gcloud-config --rm -v /var/run/docker.sock:/var/run/docker.sock ernestoalejo/google-cloud-sdk-with-docker sh -c "gcloud preview docker pull gcr.io/XXXXX/influxdb"
  Pulling repository gcr.io/XXXXX/influxdb
  time="2015-05-08T06:38:55Z" level="fatal" msg="HTTP code: 403" 
  ERROR: (gcloud.preview.docker) A Docker command did not run successfully.
  Tried to run: 'docker pull gcr.io/XXXXX/influxdb'
  Exit code: 1
  </code></pre>
  
  <p>There is only one account in the server and is correctly configured:</p>
  
  <pre><code>core@XXXX ~ $ /usr/bin/docker run --volumes-from gcloud-config --rm -v /var/run/docker.sock:/var/run/docker.sock ernestoalejo/google-cloud-sdk-with-docker sh -c "gcloud auth list"
  
  To set the active account, run:
    $ gcloud config set account ``ACCOUNT''
  
  Credentialed accounts:
   - XXXXXXXXXXXXX@developer.gserviceaccount.com (active)
  </code></pre>
  
  <p>How can I authorize the external machine to download images from the registry?</p>
  
  <p><strong>NOTE:</strong> The image <code>ernestoalejo/google-cloud-sdk-with-docker</code> is the same as <code>google/cloud-sdk</code> but with <a href="https://github.com/GoogleCloudPlatform/cloud-sdk-docker/issues/23" rel="nofollow noreferrer">this issue</a> fixed.</p>
  
  <p><strong>UPDATE:</strong> I have also tried the solution of <a href="https://stackoverflow.com/questions/29291576/access-google-container-registry-without-the-gcloud-client">this answer</a>, but it makes no difference.</p>
  
  <pre><code>PROJECT_ID=XXXXXX
  ROBOT=XXXXXX@developer.gserviceaccount.com
  gsutil acl ch -u $ROBOT:R gs://artifacts.$PROJECT_ID.appspot.com
  gsutil -m acl ch -R -u $ROBOT:R gs://artifacts.$PROJECT_ID.appspot.com
  gsutil defacl ch -u $ROBOT:R gs://artifacts.$PROJECT_ID.appspot.com
  </code></pre>