Bitbucket Cloud · Pipelines · Checked November 2, 2026

Bitbucket Pipelines: "authorization denied by plugin pipelines"

The Docker daemon that services: - docker gives your step refuses some Docker options on Atlassian's own build machines, to keep a shared environment safe. The command stops with this error, often followed by the option it refused:

Error response from daemon: authorization denied by plugin pipelines: --privileged=true is not allowed

Atlassian's page Run Docker commands in Bitbucket Pipelines lists what is blocked, and says the restrictions do not apply in Runtime v3.

What is blocked

docker run (docker container run): --cap-add, --device, --ipc, --mount, --pid, --privileged, --security-opt, --userns, --uts, and --volume / -v unless the path is under the build directory your repository is cloned into ($BITBUCKET_CLONE_DIR).
docker update: --devices. docker exec: --privileged. docker build: --security-opt.
With BuildKit: multi-architecture builds, the --platform option, the Buildx plugin, and the Dockerfile options RUN --mount=type=ssh and RUN --security=insecure. For SSH inside a build, the page points to --ssh default=$BITBUCKET_SSH_KEY_FILE.

Atlassian's article Using Docker commands protected by Pipelines in Runners adds that the list is not complete: other Docker API calls can be refused the same way. Docker Compose sends the same options to the daemon, so a compose file with a privileged service or a volume outside the clone directory stops here too.

When a plain docker build hits it

Atlassian's article Google deployment fails in Bitbucket Pipeline for Cloud (updated April 21, 2026) explains a case that surprises people, because the script never asks for --privileged.

Pipelines mounts its own Docker client into /usr/bin. Some build images, the Google Cloud SDK image among them, carry a newer client (23 or later) in /usr/local/bin, which comes first in PATH. From Docker 23, docker build runs docker buildx build, and Buildx asks for --privileged. The article gives two fixes, either one at the start of the script:

export PATH=/usr/bin:$PATH     # use the Docker client Pipelines provides
export DOCKER_BUILDKIT=0       # or: build with the legacy builder

DOCKER_BUILDKIT can also be a workspace variable, so every repository gets it without editing each file.

Runtime v3: the restrictions do not apply

Atlassian's page Enable and use Runtime v3 says docker run takes any argument there, --privileged included, and Buildx is supported. You opt in for every step or for one step:

options:
  runtime:
    cloud:
      version: 3

pipelines:
  default:
    - step:
        image: your-image-with-the-docker-cli
        services:
          - docker
        script:
          - docker run --privileged alpine:3 sh -c "echo ok"

Two things change with it. Pipelines no longer mounts the Docker CLI, so the build image has to include it or the script has to install it. And the Docker layer cache (caches: - docker) is deprecated: a step that asks for it gets a warning and no cache, and Atlassian suggests Buildx caching instead. The page also asks you to use privileged mode only when needed and only with images you trust.

Self-hosted runners

On your own runner, the default docker service still refuses these commands. The runners article defines a custom Docker service from the docker:dind image and uses it on a step that runs on the runner:

definitions:
  services:
    docker-custom:
      type: docker
      image: docker:dind

pipelines:
  default:
    - step:
        runs-on:
          - self.hosted
          - linux
        services:
          - docker-custom
        script:
          - docker run --privileged alpine:3 sh -c "echo ok"

Volumes outside the clone directory

A request to allow them on Atlassian's machines, BCLOUD-20986 (2021), was closed for low engagement in May 2025 with 5 votes. Copy the files under $BITBUCKET_CLONE_DIR and mount them from there, or move the step to Runtime v3 or a runner.

Bitbucket Pipelines in IntelliJ IDEA

Pipeline Inbox for Bitbucket Pipelines, a plugin by Lesstep for JetBrains IDEs 2024.1 or later, lists the pipelines of all your Bitbucket Cloud repositories in an IDE tool window, with their steps, the failed step and the command it stopped at, and the step's log as Bitbucket writes it. The list, steps and logs are free; running, re-running and stopping pipelines are Pro (US$1.50 a month, with a 30-day trial).

Get it on JetBrains Marketplace

Atlassian, Bitbucket and Bitbucket Pipelines are trademarks of Atlassian; Docker is a trademark of Docker, Inc.; IntelliJ IDEA is a trademark of JetBrains s.r.o. This page is not affiliated with or endorsed by Atlassian, Docker or JetBrains.

More: "Container 'docker' exceeded memory limit." · Pipelines did not run after a push · "Container 'Build' exceeded memory limit." · "Exceeded build time limit of 120 minutes" · The cache is not used · "unexpected system error" · "command not found" · Submodules not cloned · "We couldn't clone the repository" · "No online runner available" · "No space left on device" · "Step exceeded processing limits" · The artifact is missing in the next step · The build passed before and fails now · Build setup takes too long · "You've run out of build minutes" · "Permission denied to update branch" · "You have reached your pull rate limit" (Docker Hub) · "There is an error in your bitbucket-pipelines.yml" · "This pipeline was paused" (deployments) · "Cannot connect to the Docker daemon" · "Host key verification failed" (SSH) · A variable is empty · Bitbucket Pipelines plugins for IntelliJ IDEA, compared · 日本語