Azure Container Registry Docker Credentials

[Nick Zaccardi]

I am struggling hard to get Docker credentials to work for Nomad when using Azure Container Registry.

I have verified that on the VM (by SSH'ing into the machine) that I can pull the container. To do that I log in, run `az acr login -n myregistry` and then `docker pull myregistry.azureacr.io/container:tag` and it works. Nomad however throws this: Failed to pull `my-container-url`: API error (500): Get https://myregistry.azurecr.io/v2/my-container-name/manifests/my-tag: unauthorized: authentication required.

I have read the docs so many times and still am beating my head against a wall. The only thing I can't use is the auth section in the task itself. Nomad needs to get the credentials to pull the image from it's environments.

I have tried this is the client servers configuration (saw this in a GitHub Issue somewhere)

plugin "docker" {
    config {
        auth {
            config = "/root/.docker/config.json"
        }
    }
}

And this along with the docker-credentials-acr-linux executable in the path

plugin "docker" {
  config {
    auth {
      helper = "acr-linux"
    }
  }
}

I have tried adding a `az acr login -n myregistry` to the SystemD task as a ExecStartPre directive and that says `Login Succeeded`. At this point, I am not sure how to overcome this... any help appreciated.

[Robert Knochenhauer]

Hi Nick,

this is working fine.

                task "xyz" {

                        # Use Docker to run the task.

                        driver = "docker"

                        # Configure Docker driver with the image

                        config {

                          image = "#azure-containerregistry#/#folder#/#image#:#tag#"

                          port_map {

                            http = 10001

                          }

                          auth {

                            username = "XXX"

                            password = "YYY"

                            server_address = "#azure-containerregistry#.azurecr.io"

                          }

Thanks,

Robert

[Nick Zaccardi]

Thanks for the response. The problem with that is, you only get 2 admin usernames / passwords for the container registry and you will have to share them with the codebase. This doesn't seem like a great idea to me. My hope was to use a helper script to manage this which would pull the credentials as needed from the Azure metadata service.