Why does my Bitbucket pipeline fail with a permission denied error when accessing Docker registry?

Our team maintains a Bitbucket repository that uses a self‑hosted runner to build Docker images and push them to an internal container registry. The pipeline step that executes docker push consistently fails with a "permission denied" message, even though the registry URL, repository name, and tag are correct. We have stored the registry username and password as secured repository variables and injected them into the step via docker login, but the authentication still appears to be rejected. We suspect the issue could be related to how the credentials are passed, network restrictions on the runner, or a mismatch between the Docker daemon configuration and the registry’s TLS settings.

How can we confirm that the credentials supplied to docker login are being used by the Docker daemon? What checks should we perform to verify network connectivity and TLS trust between the runner and the registry? Are there specific Bitbucket Pipelines logs or environment variables that help diagnose authentication failures for Docker push?