The full hostname:port combination is required everywhere for the runner to match the DOCKER_AUTH_CONFIG. For example, if registry.example.com:5000/namespace/image:tag is specified in the .gitlab-ci.yml file, then the DOCKER_AUTH_CONFIG must also specify registry.example.com:5000. Specifying only registry.example.com does not work.