Unable to access private container registry from gcloud compute VM - docker

Question

I'm trying to pull a container from a private gcloud registry from a gcloud VM using service account for authentication. The VM and registry are in the same project. No matter what I do I always get Error response from daemon: unauthorized.
XXX#sandbox:~$ gcloud auth configure-docker gcr.io
WARNING: Your config file at [/home/XXX/.docker/config.json] contains these credential helper entries:
{
"credHelpers": {
"gcr.io": "gcloud"
}
}
Adding credentials for: gcr.io
gcloud credential helpers already registered correctly.
XXX#sandbox:~$ sudo docker pull gcr.io/MY-PROJECT-ID/MY-IMAGE:latest
Error response from daemon: unauthorized: You don't have the needed permissions to perform
this operation, and you may have invalid credentials. To authenticate your request, follow
the steps in: https://cloud.google.com/container-registry/docs/advanced-authentication
The service account has Storage Admin role for the gcr.io storage bucket:
The VM has storage access enabled as Read-Write:
The VM was stopped, restarted multiple times. Docker is up to date:
XXX#sandbox:~$ which docker
/usr/bin/docker
XXX#sandbox:~$ sudo docker version
Client: Docker Engine - Community
Version: 19.03.8
API version: 1.40
Go version: go1.12.17
Git commit: afacb8b7f0
Built: Wed Mar 11 01:26:02 2020
OS/Arch: linux/amd64
Experimental: false
Server: Docker Engine - Community
Engine:
Version: 19.03.8
API version: 1.40 (minimum version 1.12)
Go version: go1.12.17
Git commit: afacb8b7f0
Built: Wed Mar 11 01:24:36 2020
OS/Arch: linux/amd64
Experimental: false
containerd:
Version: 1.2.13
GitCommit: 7ad184331fa3e55e52b890ea95e65ba581ae3429
runc:
Version: 1.0.0-rc10
GitCommit: dc9208a3303feef5b3839f4323d9beb36df0a9dd
docker-init:
Version: 0.18.0
GitCommit: fec3683
I can get it to work using JSON keyfile but not with the recommended gcloud auth configure-docker. I guess there is some yet another undocumented switch or permission that I need to flip but I just can't see.

Answer 1

You can pass the account or the impersonate-service-account to the command:
gcloud auth configure-docker --account
gcloud auth configure-docker ----impersonate-service-account
When you run with sudo you change the environment and it will not authenticate to the gcr.io, thus the unauthorized.