Looking at https://kojipkgs.fedoraproject.org//work/tasks/4443/134744443/push.log we can see it thinks it's not logged in:

time="2025-07-11T02:16:54Z" level=fatal msg="writing blob: initiating layer upload to /v2/icecat/blobs/uploads/ in candidate-registry.fedoraproject.org: authentication required"

but we do have a /root/.docket/config.json that looks correct and fine. ;(

I don't think this is at all firewall related, as they use the proxies that they use also for package downloads, etc... so that should work fine, and the logs indeed seem to show that.

but we do have a /root/.docket/config.json that looks correct and fine. ;(

I don't think skopeo reads Docker's config file. The RH containers stack (Podman, Buildah, Skopeo) have their own.

It definitely used to... and the man page still says:

 By default, uses
       the authorization state in either $XDG_RUNTIME_DIR/containers/auth.json, which is set  us‐
       ing  (skopeo  login).  If  the  authorization state is not found there, $HOME/.docker/con‐
       fig.json is checked, which is set using (docker login).

ok. This should be fixed in ansible commit 9a22870dd7f7fd17b38b36f94461d2f607f37d5c

basically we had a '10.3' in there that needed to be '10.16'

(The old dc networks were 10.3.x.x and new ones are 10.16.x.x)

Looks like this is working fine now, I see a bunch of builds. ;)