Azure DevOps private nuget repo Unauthorized when building with docker - docker

Question

I am trying to create a docker image for my project that has a private Azure DevOps nuget repo. I am able to connect to the repo in visual studio with my credentials but when I try to build a docker image I get an error.
Unable to load the service index for source
https://{my_url}/nuget/v3/index.json Response status code does not
indicate success: 401 (Unauthorized)
I copied my Nuget.config file to the root of my project
nuget.config
<?xml version="1.0" encoding="utf-8"?>
<configuration>
<disabledPackageSources>
<add key="Microsoft and .NET" value="true" />
</disabledPackageSources>
<activePackageSource>
<add key="nuget.org" value="https://api.nuget.org/v3/index.json" />
</activePackageSource>
<packageSources>
<add key="nuget.org" value="https://api.nuget.org/v3/index.json" protocolVersion="3" />
<add key="libraries" value="https://{my_url}/nuget/v3/index.json" />
</packageSources>
<packageSourceCredentials>
<libraries>
<add key="Username" value="{my_username}" />
<add key="ClearTextPassword" value="{my_pass}" />
</libraries>
</packageSourceCredentials>
</configuration>
and this is my dockerfile
FROM mcr.microsoft.com/dotnet/core/aspnet:3.0.0-preview8-nanoserver-1903 AS base
WORKDIR /app
EXPOSE 80
EXPOSE 443
FROM mcr.microsoft.com/dotnet/core/sdk:3.0.100-preview8-nanoserver-1903 AS build
WORKDIR /src
COPY NuGet.config "MyProject/"
COPY ["MyProject/MyProject.csproj", "MyProject/"]
COPY . .
RUN dotnet restore "MyProject/MyProject.csproj"
WORKDIR "/src/MyProject"
RUN dotnet build "MyProject.csproj" -c Release -o /app
FROM build AS publish
RUN dotnet publish "MyProject.csproj" -c Release -o /app
FROM base AS final
WORKDIR /app
COPY --from=publish /app .
ENTRYPOINT ["dotnet", "MyProject.dll"]
I am not sure what else to do for it to be able to connect to my repo

Answer 1

I stumbled across this post.
(ref: solution # the bottom)
Basically, change the PAT Organization to "All accessible organizations" AND scroll through the permission\security sections and set the following:
Build (Artifacts, definitions, requests, queue a build, and updated build properties): Read
Connected server (Access endpoints): Connected server
Packaging (Create, read, update, and delete feeds and packages): Read
(Not sure if all of these are required.)
Docker File:
FROM mcr.microsoft.com/dotnet/core/aspnet:2.2-stretch-slim AS base
WORKDIR /app
FROM mcr.microsoft.com/dotnet/core/sdk:2.2-stretch AS build
WORKDIR /src
# The Personal Access Token arg
ARG PAT
# Set environment variables
ENV NUGET_CREDENTIALPROVIDER_SESSIONTOKENCACHE_ENABLED true
ENV VSS_NUGET_EXTERNAL_FEED_ENDPOINTS '{"endpointCredentials":[{"endpoint":"https://pkgs.dev.azure.com/ORG/_packaging/FEEDNAME/nuget/v3/index.json","username":"USERNAME","password":"'${PAT}'"}]}'
# Get and install the Artifact Credential provider
RUN wget -O - https://raw.githubusercontent.com/Microsoft/artifacts-credprovider/master/helpers/installcredprovider.sh | bash
COPY ["PROJECTNAME.csproj", "./"]
RUN dotnet restore -s "https://pkgs.dev.azure.com/ ORG /_packaging/ FEEDNAME /nuget/v3/index.json" -s "https://api.nuget.org/v3/index.json"
COPY . ./
WORKDIR /src
RUN dotnet build " PROJECTNAME.csproj" -c Release -o /app
FROM build AS publish
RUN dotnet publish --no-restore " PROJECTNAME.csproj" -c Release -o /app
FROM base AS final
WORKDIR /app
COPY --from=publish /app .
ENTRYPOINT ["dotnet", " PROJECTNAME.dll"]
docker command:
docker build -t BUILDNAME:local . --build-arg PAT=xxxxxxxxxxxxxxxxxxxxxxxxx
Previously we were using a nuget.config file with credentials\PAT and this was working. I have no idea what changed to cause it to stop. If anyone had an idea pls post.

Answer 2

you need to force dotnet restore to use your config file:
RUN dotnet restore "MyProject/MyProject.csproj" --configfile Nuget.Config
alternatively you can do something like this in your dockerfile:
# Add Environment Variables references for access private Azure Artifacts Repository
# Use --build-arg <ARG> to pass this in.
ARG TOKENPASS
ARG TOKENUSER
ARG NUGET_ENDPOINT
# Fetch Azure Artifacts "Magic" credentials providers
RUN wget -qO- https://raw.githubusercontent.com/Microsoft/artifacts-credprovider/master/helpers/installcredprovider.sh | bash
# Needs to be enabled to fetch the private repository credentials for NuGet restore.
ENV NUGET_CREDENTIALPROVIDER_SESSIONTOKENCACHE_ENABLED true
ENV VSS_NUGET_EXTERNAL_FEED_ENDPOINTS="{\"endpointCredentials\": [{\"endpoint\":\"$NUGET_ENDPOINT\", \"username\":\"$TOKENUSER\", \"password\":\"$TOKENPASS\"}]}"
# Workaround of some kind to help Azure Artifact Private repository image collection.
ENV DOTNET_SYSTEM_NET_HTTP_USESOCKETSHTTPHANDLER 0
and use docker build with --build-arg TOKENPASS=$(TOKENPASS) --build-arg TOKENUSER=$(TOKENUSER) --build-arg NUGET_ENDPOINT=$(NUGET_ENDPOINT)