I am unable to run a health check using the Azure CLI. I am on MacOS Monterey. Below is the error:
➜ az acr check-health -n <ACR_NAME>
Docker daemon status: available
Docker version: 'Docker version 20.10.12, build 459d0df, platform linux/amd64'
This will pull the image mcr.microsoft.com/mcr/hello-world:latest. Proceed? (y/n): y
Docker pull of 'mcr.microsoft.com/mcr/hello-world:latest' : OK
Azure CLI version: 2.33.1
DNS lookup to <ACR_NAME>.azurecr.io at IP 20.42.66.2 : OK
Challenge endpoint https://<ACR_NAME>.azurecr.io/v2/ : OK
Fetch refresh token for registry '<ACR_NAME>.azurecr.io' : OK
Fetch access token for registry '<ACR_NAME>.azurecr.io' : OK
Helm version: 3.8.0
An error occurred: NOTARY_COMMAND_ERROR
Please verify if notary is installed.
Please refer to https://aka.ms/acr/errors#notary_command_error for more information.
The support URL provided does not lead to anywhere useful.
Not sure if it helps, but I'm able to login to my ACR just fine:
➜ az acr login --name <ACR_NAME>
Login Succeeded
Has anyone else faced this error/issue? What am I missing here?
According too azure/container-registry| Microsoft Docs.
Azure Container Registry does not officially support the Notary CLI
but is compatible with the Notary Server API, which is included with
Docker Desktop. Currently Notary version 0.6.0 is recommended
So please try the suggestion provided in comment by #madhuraj.
It looks like a known issue .See if below can be workaround.
Try to enable content trust at the registry level.
Or
In Bash
export DOCKER_CONTENT_TRUST=1
Enable content trust for single command
docker build --disable-content-trust=false -t myacr.azurecr.io/myimage:v1 .
In azure CLI
$ docker push myregistry.azurecr.io/myimage:v1
Please check enable registry content trust | Microsoft Docs for further details.
$ docker pull myregistry.azurecr.io/myimage:signed
Or see azure container registry - Stack Overflow reference
set DOCKER_CONTENT_TRUST=1
docker push myregistry.azurecr.io/image:tag
If the issue remains please raise a support request from overview blade > Support + troubleshooting >New Support Request.
References:
https://docker-docs-notary
Registry authentication options - Azure Container Registry |
Microsoft Docs
behind-the-scenes - Azure Container Registry | Microsoft Docs
set AZURE_CLI_DISABLE_CONNECTION_VERIFICATION=1 and voila, you won't get NOTARY_COMMAND_ERROR with az acr login command.
I faced the same issue and fixed it by the following command (installing notary v0.6.1)
$ go install github.com/notaryproject/notary/cmd/notary#v0.6.1
See https://github.com/notaryproject/notary for what the notary is.
...
And well, the command was useless though (sigh
Related
So I have my docker image uploaded to my projects registry. I can navigate to https://console.cloud.google.com/gcr/images/ and I see my Image listed there.
Now I want to run a VM on this project and on this one use docker to run this very image.
This is the command within my VM:
sudo /usr/bin/docker run eu.gcr.io/my-project-name/example001
The response is:
Unable to find image 'eu.gcr.io/.../example001:latest' locally
/usr/bin/docker: Error response from daemon: unauthorized: You don't have the needed permissions to perform this op
eration, and you may have invalid credentials. To authenticate your request, follow the steps in: https://cloud.goo
gle.com/container-registry/docs/advanced-authentication.
See '/usr/bin/docker run --help'.
Please see the image attached. I can list my images if I define "eu.gcr.io/..." as my project path. However the machine seems to run on ".gcr.io" so therefor not able to access my image? How would I fix this - and why is my image on "eu.gcr.io" and the machine on ".gcr.io", I cant find a method to change this (either move the image to gcr.io or move the machine to, eu.gcr.io). However I'm not sure if this is the issue.
Maybe it is an authentication issue with docker?
VM basically cannot be on ".gcr.io", it can run in non-European region/zone, but it shouldn't be a problem.
From GCP access control point of view registry is just a bucket.
So I believe first thing you need to check is that VM has access to Google Cloud Storage.
With gcloud:
gcloud compute instances describe <instance-name>
check if VM has scope to read from devstorage:
serviceAccounts:
- email: ...-compute#developer.gserviceaccount.com
scopes:
- https://www.googleapis.com/auth/devstorage.read_only
- ...
This scope should be in place to read from registry:
https://www.googleapis.com/auth/devstorage.read_only
If you don't have such scope on VM, but have there gcloud configured, you can use gcloud as credential helper:
gcloud auth configure-docker
as stated in doc you referred: https://cloud.google.com/container-registry/docs/advanced-authentication#gcloud_as_a_docker_credential_helper
The answer is found here:
https://serverfault.com/questions/900026/gcp-no-access-to-container-registry-from-compute-engine
It is the docker command which needs the authorization. Not the hostname (eu.gcr.io) is the issue here. I used 'gcloud docker -- pull ...' command to get the image from the repository to use within my VM.
after you create linux VM on GCP, SSH to it, you have to install Google SDK 1 using Cloud SDK with scripts]1 or manually.
If you are running Ubuntu follow the documentation here if you are installing with Red Hat or CentOS follow the documentation here after finishing the Google SDK you have to Run gcloud init to initialize the SDK, just open a terminal and tape [gcloud init] you have to configure your profile. after that you have to install Docker
sudo apt-get -y install docker-ce
sudo systemctl start docker
You need to have access to the registries which you will be pushing to and pulling from.
Configured Docker to use gcloud as a credential helper. To use gcloud as the crediential helper, run the command:
gcloud auth configure-docker
After that you can pull or push images on your registry using the gcloud command with the docker as shown below:
Push: gcloud docker -- push gcr.io/google-containers/example-image:latest
pull: gcloud docker -- pull gcr.io/google-containers/example-image:latest
When I do gcloud docker push i get the following error.
denied: Unable to create the repository, please check that you have access to do so.
gcloud info shows correct project name as configured in gcloud.
Can somebody please guide me with this issue? Or suggest an alternative.
I have tried directly logging in without gcloud, login succeeds but push fails
$docker login -e 2983212121577-compute#developer.gserviceaccount.com -u oauth2accesstoken -p "$(gcloud auth print-access-token)" https://gcr.io
Flag --email has been deprecated, will be removed in 1.14.
Login Succeeded
$ docker push gcr.io/project/imagename
...
denied: Unable to create the repository, please check that you have access to do so.
$ gcloud --version
Google Cloud SDK 147.0.0
$ docker --version
Docker version 17.03.0-ce, build 3a232c8
If you do
gcloud docker -- push gcr.io/X/Y
you will need to have permission to write to the GCP named 'X'. Typically you will need to be added to that project as a project EDITOR.
In this case GCR does not complain about the project shown by 'gcloud info'.
I am trying to push a Docker image to Google Container Registry from a CircleCI build, as per their instructions. However, pushing to GCR fails due to an apparent authentication error:
Using 'push eu.gcr.io/realtimemusic-147914/realtimemusic-test/realtimemusic-test' for DOCKER_ARGS.
The push refers to a repository [eu.gcr.io/realtimemusic-147914/realtimemusic-test/realtimemusic-test] (len: 1)
Post https://eu.gcr.io/v2/realtimemusic-147914/realtimemusic-test/realtimemusic-test/blobs/uploads/: token auth attempt for registry: https://eu.gcr.io/v2/token?account=oauth2accesstoken&scope=repository%3Arealtimemusic-147914%2Frealtimemusic-test%2Frealtimemusic-test%3Apush%2Cpull&service=eu.gcr.io request failed with status: 403 Forbidden
I've prior to pushing the Docker image authenticated the service account against Google Cloud:
echo $GCLOUD_KEY | base64 --decode > ${HOME}/client-secret.json
gcloud auth activate-service-account --key-file ${HOME}/client-secret.json
gcloud config set project $GCLOUD_PROJECT_ID
Then I build the image and push it to GCR:
docker build -t $EXTERNAL_REGISTRY_ENDPOINT/realtimemusic-test -f docker/test/Dockerfile .
gcloud docker push -- $EXTERNAL_REGISTRY_ENDPOINT/realtimemusic-test
What am I doing wrong here?
Have you tried using the _json_key method for authenticating with Docker?
https://cloud.google.com/container-registry/docs/advanced-authentication
After that, please use naked 'docker' (without 'gcloud').
If you are pushing docker image using google cloud sdk. You can use temporary authorization with the following command:
gcloud docker --authorize-only
The above command gives you a temporary authorization for pushing and pulling images using docker.
You can refer this link for details Gcloud docker.
Hope it helps to solve your issue.
After many retries... I solved using access token:
gcloud auth print-access-token | docker login -u oauth2accesstoken --password-stdin https://[HOSTNAME]
The service account requires permission to write to the Cloud Storage bucket containing the container registry. Granting the service account either the project editor role or write access to the bucket (via ACL) solves the issue. The latter should be preferable since the account doesn't receive wider permissions than it needs.
I created my dockers using a makefile, and checked if it was correct. In fact, I was able to run it and even upload to Docker Hub without problems. I then followed the steps suggested to upload the docker to Bluemix, and was unable to do it. I am getting an error telling me that my credentials are incorrect, although I am sure they are not (in fact, I was able to login on the Bluemix website using the same credential without problems).
See below the steps I did and the error obtained, any suggestion to solve them will be welcomed:
$ cf login
API endpoint: https://api.eu-gb.bluemix.net
Email> agorostidi
Password>
Autenticando...
OK
Org seleccionada agorostidi
Space seleccionado dev
Endpoint API: https://api.eu-gb.bluemix.net (version de API: 2.40.0)
Usuario: andres.gorostidi#gmail.com
Org: agorostidi
Space: dev
MacBook-Pro-de-Andres:apache-docker andres$ cf ic login
Client certificates are being retrieved from IBM Containers...
Client certificates are being stored in /Users/andres/.ice/certs/...
Client certificates are being stored in /Users/andres/.ice/certs/containers-api.eu-gb.bluemix.net/504cc61c-47e2-4528-914a-3def71277eea...
OK
Client certificates were retrieved.
Deleting old configuration file...
Checking local Docker configuration...
OK
Authenticating with registry at host name registry.eu-gb.bluemix.net
OK
Your container was authenticated with the IBM Containers registry.
Your private Bluemix repository is URL: registry.eu-gb.bluemix.net/goros
You can choose from two ways to use the Docker CLI with IBM Containers:
Option 1: This option allows you to use "cf ic" for managing containers on IBM Containers while still using the Docker CLI directly to manage your local Docker host.
Use this Cloud Foundry IBM Containers plug-in without affecting the local Docker environment:
Example Usage:
cf ic ps
cf ic images
Option 2: Use the Docker CLI directly. In this shell, override the local Docker environment to connect to IBM Containers by setting these variables. Copy and paste the following commands:
Note: Only Docker commands followed by (Docker) are supported with this option.
export DOCKER_HOST=tcp://containers-api.eu-gb.bluemix.net:8443
export DOCKER_CERT_PATH=/Users/andres/.ice/certs/containers-api.eu-gb.bluemix.net/504cc61c-47e2-4528-914a-3def71277eea
export DOCKER_TLS_VERIFY=1
Example Usage:
docker ps
docker images
MacBook-Pro-de-Andres:apache-docker andres$ docker push registry.ng.bluemix.net/eci_test/chargeback:latest
The push refers to a repository [registry.ng.bluemix.net/eci_test/chargeback] (len: 1)
Sending image list
Please login prior to push:
Username: agorostidi
Password:
Email: andres.gorostidi#gmail.com
Error response from daemon: Wrong login/password, please try again
You logged in to the Bluemix London region and are trying to push an image to the Bluemix US South region, that's why docker push command is asking for your credentials again.
If you want to push your images to the Bluemix US South region you have to login to that region first.
Please point your API to the Bluemix US South region with the following command:
$ cf api https://api.ng.bluemix.net
Then proceed again with the commands you run before, i.e.:
$ cf login
$ cf ic login
$ docker push registry.ng.bluemix.net/eci_test/chargeback:latest
Otherwise, if you want to push your image to the Bluemix London region, then you have to re-tag the image name to match the London region:
$ docker tag chargeback:latest registry.eu-gb.bluemix.net/eci_test/chargeback:latest
Then you can run the docker push command specifying the new tagged image.
I'm trying to create a simple ubuntu image on docker within Bluemix.
I have the cli setup (at the latest version) but keep getting a login prompt when trying to push the image.
My dockerfile is trivial:
FROM docker.io/ubuntu:latest
MAINTAINER My Name
RUN echo "Imaged" > /tmp/image.txt
I build it with
sudo docker build -t ubuntu
then tag it with
sudo docker tag ubuntu registry.eu-gb.bluemix.net/MYNAMESPACE/ubuntu
I login with
cf login
Then push with
[ibmcloud#analyticsadmin docker]$ sudo docker push registry.ng.bluemix.net/MYNAMESPACE/ubuntu
The push refers to a repository [registry.ng.bluemix.net/MYNAMESPACE/ubuntu] (len: 1)
Sending image list
Please login prior to push:
Username:
I'm new to bluemix/docker so user error is highly likely. Can you spot my error? My DOCKER* environment variables are set as appropriate for my bluemix container service.
It seems you missed the step to login to the IBM Containers registry, that's why docker push is asking you for the username.
After cf login you have to run the following command as well:
$ cf ic login
This will authenticate you to the IBM Containers registry so you can push your images.
Please note that ic is a plugin you have to install for the cf command line interface. If you have not installed it yet please see instructions in the following link:
https://www.ng.bluemix.net/docs/containers/container_cli_cfic.html#container_cli_cfic_install
For example to install plugin in Linux system run the following command:
$ cf install-plugin https://static-ice.ng.bluemix.net/ibm-containers-linux_x64
A typo I see in your commands is that you tag your container for sending it to the UK data center (eu-gb) then try to push it to the south US one (ng), that's why I think the second command asks you to login.