How to authenticate with private ACR registry?

[181192]

Running docker compose up on a docker-compose.yml file with images located in a private ACR registry results in a ACI error:

containerinstance.ContainerGroupsClient#CreateOrUpdate: Failure sending request: StatusCode=400 -- Original Error: Code="InvalidImageRegistryPassword" Message="The password in the 'imageRegistryCredentials' of container group 'test' cannot be empty."

Or running a single container:

$ docker run ***.azurecr.io/poc/nginx
[+] Running 0/1
 ⠧ wizardly-meitner  Waiting                                                                                                                                                            0.7s
containerinstance.ContainerGroupsClient#CreateOrUpdate: Failure sending request: StatusCode=400 -- Original Error: Code="InvalidImageRegistryPassword" Message="The password in the 'imageRegistryCredentials' of container group 'wizardly-meitner' cannot be empty."

With pure ACI ARM template its possible to define image registry credentials like:

"imageRegistryCredentials": [
  {
    "server": "imageRegistryLoginServer",
    "username": "imageRegistryUsername",
    "password": "imageRegistryPassword"
  }
]

How to authenticate with a private ACR registry when deploying to ACI?

[gtardif]

Hi, you can docker login against your ACR registry, or login using the az acr login command line, that will result in transparently docker login. Once you are logged in and can push/pull to the ACR repo, you should be able to run the docker compose up to ACI, and your ACR login will be transferred with the deployment info.

[181192]

docker version
Client: Docker Engine - Community
 Azure integration  0.1.4
 Version:           19.03.12
 API version:       1.40
 Go version:        go1.13.10
 Git commit:        48a66213fe
 Built:             Mon Jun 22 15:45:44 2020
 OS/Arch:           linux/amd64
 Experimental:      false

Server: Docker Engine - Community
 Engine:
  Version:          19.03.12
  API version:      1.40 (minimum version 1.12)
  Go version:       go1.13.10
  Git commit:       48a66213fe
  Built:            Mon Jun 22 15:44:15 2020
  OS/Arch:          linux/amd64
  Experimental:     false
 containerd:
  Version:          1.2.13
  GitCommit:        7ad184331fa3e55e52b890ea95e65ba581ae3429
 runc:
  Version:          1.0.0-rc10
  GitCommit:        dc9208a3303feef5b3839f4323d9beb36df0a9dd
 docker-init:
  Version:          0.18.0
  GitCommit:        fec3683

I have tried authenticating both with az acr login -n *** and docker login azure, and getting Login succeded

 $ az acr login -n ***
Login Succeeded

The image is pushed to the ACR registry.

But running docker run or docker compose up gives the 400 error message.

$ docker -D run  -p 80:80 ***.azurecr.io/poc/nginx
DEBU[0000] Running container "***.azurecr.io/poc/nginx" with name "magical-archimedes" 
[+] Running 0/1
 ⠦ magical-archimedes  Waiting                                                                                                                                                          0.6s
containerinstance.ContainerGroupsClient#CreateOrUpdate: Failure sending request: StatusCode=400 -- Original Error: Code="InvalidImageRegistryPassword" Message="The password in the 'imageRegistryCredentials' of container group 'magical-archimedes' cannot be empty."

[gtardif]

Thx @181192 for the error message. I'll dig into this, it might be an error depending on how you login to ACR (there are several possible options)

[gtardif]

Thanks for the feedback, this happens to be a linux-specific issue, will be fixed in the next release.

[181192]

Thanks, looking forward to next release!

FYI: I got it working by logging in with a Service Principal

docker login ***.azurecr.io --username *** --password ***

[gtardif]

Sorry I just realised this was closed a bit in advance, was meaning to close the issue once the fix is released.
This is now done, v0.1.7 should work better. Don't hesitate to reopen if you are still having issues