We have a Jenkins install that uses AWS ECR as a registry. We authenticate using the aws credentials chain (instance profile). Today we updated the Declarative plugin to 1.3.5 which broke all of our builds. Checking the changelog as Jira guidelines suggest do not include any changes to docker, however after reviewing the commit log in the repository it seems that JENKINS-49950 is an unlisted change between 1.3.4.1 and 1.3.5.

Pipeline code that worked prior to the update:

agent {
    docker {
        image 'base/php:7.2-cli'
        registryUrl "https://$DOCKER_REPOSITORY_HOST"
    }
}

After updating the plugin, the pipeline will not check the registry for the image.

Log output prior to update:

[Pipeline] // stage
[Pipeline] withEnv
[Pipeline] {
[Pipeline] withEnv
[Pipeline] {
[Pipeline] withDockerRegistry
[Pipeline] {
[Pipeline] sh
+ docker inspect -f . base/php:7.2-cli

Error: No such object: base/php:7.2-cli
[Pipeline] sh
+ docker inspect -f . 12345678910.dkr.ecr.us-east-1.amazonaws.com/base/php:7.2-cli

Log output after updating:

[Pipeline] // stage
[Pipeline] withEnv
[Pipeline] {
[Pipeline] sh
+ docker inspect -f . base/php:7.2-cli

Error: No such object: base/php:7.2-cli
[Pipeline] sh
+ docker pull base/php:7.2-cli
Error response from daemon: pull access denied for base/php, repository does not exist or may require 'docker login'

We have never needed to provide the credentailsId, however commit https://github.com/jenkinsci/pipeline-model-definition-plugin/commit/28d0aca0d9f4d54ee25e4d393a6683d92055aad3 appears to make this required. There was no indication that this would not be backwards compatible in the changelog.

 Upon reverting the Declarative plugin to 1.3.4.1 has restored functionality. No other plugin needed to be rolled back.