This works ...

❯ docker pull registry.gitlab.com/{MY_PROJECT}
❯ docker images
REPOSITORY                              TAG                 IMAGE ID            CREATED             SIZE
registry.gitlab.com/{MY_PRIVATE_IMAGE}    latest              XXXX        2 days ago          605MB

❯ gitlab-runner verify
WARNING: Running in user-mode.
WARNING: Use sudo for system-mode:
WARNING: $ sudo gitlab-runner...

Verifying runner... is alive                        runner={XXXX}

❯ cat /.gitlab-runner/config.toml
concurrent = 1
check_interval = 0

[[runners]]
  name = "macbook-{XXXX}"
  url = "gitlab.com"
  token = "XXXXXXX"
  executor = "docker"
  [runners.docker]
    tls_verify = false
    image = "registry.gitlab.com/{MY_PRIVATE_IMAGE}:latest"
    privileged = true
    disable_cache = false
    volumes = ["/cache"]
    shm_size = 0
  pull_policy = "if-not-present"
  [runners.cache]
❯ cat ../../../.docker/config.json
{
    "auths": {
        "index.docker.io/v1": {},
        "registry.gitlab.com": {},
        "registry.gitlab.com": {}
    },
    "credsStore": "osxkeychain"
}

In my project when I try to execute runner ..

❯ gitlab-runner exec docker lint
WARNING: You most probably have uncommitted changes.
WARNING: These changes will not be tested.
Running with gitlab-ci-multi-runner 9.4.0 (ef0b1a6)
  on  ()
Using Docker executor with image registry.gitlab.com/{MY_PRIVATE_IMAGE} ...
map[]
Using docker image sha256:XXXX for predefined container...
Pulling docker image registry.gitlab.com/{MY_PRIVATE_IMAGE} ...
ERROR: Preparation failed: Error response from daemon: Get https://registry.gitlab.com/v2/{MY_PRIVATE_IMAGE}/manifests/latest: denied: access forbidden
Will be retried in 3s ...
Using Docker executor with image registry.gitlab.com/{MY_PRIVATE_IMAGE} ...
map[]
Using docker image sha256:XXX for predefined container...