This usually happens because Railway cannot authenticate to the private registry, not because the image is missing.

Try this exact setup:

For GHCR:

Image name:

ghcr.io/OWNER/IMAGE_NAME:TAG

Railway credentials:

Username: your GitHub username

Password: GitHub personal access token classic, not fine-grained token

Token scope:

read:packages

Also check:

1. The GHCR package is actually visible to that user/token.
2. If it is under an organization, authorize SSO for the token.
3. Use the exact same casing/path as the image, preferably lowercase.
4. Include the tag, for example :latest or your real pushed tag.

Test locally first:

echo YOUR_TOKEN | docker login ghcr.io -u YOUR_GITHUB_USERNAME --password-stdin
docker pull ghcr.io/OWNER/IMAGE_NAME:TAG

For Docker Hub:

Image name:

DOCKERHUB_USERNAME/REPO_NAME:TAG

Railway credentials:

Username: Docker Hub username

Password: Docker Hub access token or password

Test locally:

echo YOUR_TOKEN | docker login -u YOUR_DOCKERHUB_USERNAME --password-stdin
docker pull DOCKERHUB_USERNAME/REPO_NAME:TAG

If the local docker pull fails, Railway will fail too. Fix the image path, tag, token scope, or package permissions first.

If local docker pull works but Railway still says it cannot find/pull the image, then it is likely a Railway registry-auth issue. Send Railway the exact image path and say: “This image pulls successfully locally with the same registry credentials, but Railway cannot pull it.”

Railway’s docs say private registry deployments require Pro and need registry credentials. For GHCR specifically, Railway says to use a personal access token classic. GitHub’s docs also say GHCR authentication uses a classic PAT with at least read:packages for pulling private packages.

This is almost always an auth problem, not a missing image. Railway saying it can't find the container usually means the registry rejected the credentials...Try to test it locally first. Run docker login then docker pull with the exact same image reference you're giving Railway. If that fails locally, it'll fail on Railway too, so fix that first.

For GHCR specifically:

-Use the full path: ghcr.io/OWNER/IMAGE_NAME:TAG

-Use a classic personal access token, not a fine-grained one. Fine-grained tokens are flaky with GHCR.

-Token needs the read:packages scope.

-If the image is under an org, authorize the token for SSO or it'll silently fail.

-For Docker Hub it's USERNAME/REPO:TAG with an access token or password.

If local docker pull works but Railway still fails, then it's a registry auth issue on Railway's end and worth raising with support.

The most likely culprit based on what you've described: you're using a fine-grained token instead of a classic PAT.

GHCR — swap your token:

Go to GitHub → Settings → Developer settings → Personal access tokens → Tokens (classic)

Generate new token with read:packages scope

Update that token in Railway's registry credentials

Docker Hub — check your image reference:

Make sure it's exactly username/repo:tag with an explicit tag, not just username/repo

Run this to confirm your credentials actually work before touching Railway again:

bashecho YOUR_TOKEN | docker login ghcr.io -u YOUR_USERNAME --password-stdin

docker pull ghcr.io/OWNER/IMAGE:TAG

If that fails, the token is the problem. If it succeeds and Railway still fails, contact Railway support.