Is it possible to use private Docker Hub images?

[bmalehorn]

I'm trying to follow the instructions here, which tell you set three environment variables:
https://docs.github.com/en/codespaces/codespaces-reference/allowing-your-codespace-to-access-a-private-image-registry

I've set these:

DOCKER_CONTAINER_REGISTRY_SERVER=registry.hub.docker.com
DOCKER_CONTAINER_REGISTRY_USER=bmalehorn
DOCKER_CONTAINER_REGISTRY_PASSWORD=<redacted>

However, when I try to run a codespaces, I get this error:

Step 1/2 : FROM opendoor/godoc
pull access denied for opendoor/godoc, repository does not exist or may require 'docker login': denied: requested access to the resource is denied

It didn't log in as my account.
I also tried setting an incorrect password, and I still got the same error - it seems like Codespaces isn't recognizing my secrets.
Has anyone got Codespaces working with Docker Hub?

Steps to reproduce

1. Make a new git repo with these dev container settings:

.devcontainer/devcontainer.json

{
  "name": "test-codespaces",
  "build": {
    "dockerfile": "Dockerfile",
    "context": ".."
  }
}

.devcontainer/Dockerfile

# private image
FROM opendoor/godoc

RUN echo 'Brian was here' >> /bmalehorn

2. Click Settings > Secrets > Codespaces and set the following repo-level secrets to your own credentials:

DOCKER_CONTAINER_REGISTRY_SERVER
DOCKER_CONTAINER_REGISTRY_USER
DOCKER_CONTAINER_REGISTRY_PASSWORD

Ensure your account has access to the private image in the previous step.

3. Click Code > New Codespace from the new repo

Expected: it loads the new image
Actual:

docker log

Configuration starting...
Using image: mcr.microsoft.com/vscode/devcontainers/universal:1
Creating container...
[39 ms] @microsoft/vscode-dev-containers-cli 0.42.0.
[197 ms] Start: Run: docker run --sig-proxy=false -a STDOUT -a STDERR --mount type=bind,src=/var/lib/docker/codespacemount/workspace,dst=/workspaces --mount source=/root/.codespaces/shared,target=/workspaces/.codespaces/shared,type=bind --mount source=/var/lib/docker/codespacemount/.persistedshare,target=/workspaces/.codespaces/.persistedshare,type=bind --mount source=/.codespaces/agent/mount,target=/.codespaces/bin,type=bind --mount source=/mnt/containerTmp,target=/tmp,type=bind --mount type=bind,src=/.codespaces/agent/mount/cache,dst=/vscode -l Type=codespaces -l vsch.remote.devPort=0 -e CODESPACES=true -e RepositoryName=null -e ContainerVersion=11 --cap-add=SYS_PTRACE --security-opt seccomp=unconfined --privileged --init --label ContainerVersion=11 --hostname codespaces_e41012 --add-host codespaces_e41012:127.0.0.1 --network host --label IsWarmUpContainer=true mcr.microsoft.com/vscode/devcontainers/universal:1
Configuring codespace...
Finished configuring codespace.


Configuration starting...
Cloning...
$ git -C "/var/lib/docker/codespacemount/workspace" clone --depth 1 https://github.com/opendoor-labs/test-codespaces "/var/lib/docker/codespacemount/workspace/test-codespaces"
Cloning into '/var/lib/docker/codespacemount/workspace/test-codespaces'...
git process exited with exit code 0
$ git -C "/var/lib/docker/codespacemount/workspace/test-codespaces" config --local remote.origin.fetch +refs/heads/*:refs/remotes/origin/*
git process exited with exit code 0

Creating container...
[13 ms] @microsoft/vscode-dev-containers-cli 0.42.0.
[107 ms] Start: Run: docker build -f /var/lib/docker/codespacemount/workspace/test-codespaces/.devcontainer/Dockerfile -t vsc-test-codespaces-92135f90d2c9a5a4204b669d749362b0 /var/lib/docker/codespacemount/workspace/test-codespaces
Sending build context to Docker daemon  61.95kB
Step 1/2 : FROM opendoor/godoc
pull access denied for opendoor/godoc, repository does not exist or may require 'docker login': denied: requested access to the resource is denied
Failed to create container.Error: Command failed: docker build -f /var/lib/docker/codespacemount/workspace/test-codespaces/.devcontainer/Dockerfile -t vsc-test-codespaces-92135f90d2c9a5a4204b669d749362b0 /var/lib/docker/codespacemount/workspace/test-codespacesError Code: 1302Container creation failed.
Creating recovery container.

[Chuxel]

A couple of things to check.

1. First, change registry.hub.docker.com to https://index.docker.io/v1/.

2. Be sure the secrets you've created are assigned to the repository you'll be using them in if you set them at the user or organization level.

   

3. You may need to stop and then start the Codespace you are in for the new environment variables to be passed into the container. (F1 or Ctrl+Shift+P > Codespaces: Stop Current Codespace)

[bmalehorn]

@divyenduz You can add secrets at the organization level or the repository level. When you edit at the organization level, you have to tell it which repositories should have access to the secret. But since you're editing at the repository level, it will always have access to that repository so there's no need for a "Repository access" option.

[divyenduz]

Aha, so I think this is a bug because my docker login doesn't work and I can't even see the env var in the container, if I do echo $CR_PAT from the codespace container, it is empty

[Chuxel]

You will need to stop and start your codespace before any new secrets take effect. In addition, you need to use the specific secret names described in the docs for them to be picked up so you can reference a private image for your development container.

[divyenduz]

Thanks, manually stopping/starting the Codespace worked. Curious, is stopping/starting different from re-building the container?

I wish debugging this was easier with maybe logs or UI showing list of env vars names attached to a container.

Thank you for the quick replies 🙌🏼

[Chuxel]

Yes, rebuilding keeps the compute running "hot" so the process is quick. The variables are injected when the codespace starts up, and a stop will bring everything completely down.

[GavinRay97]

Is there any way you can enable this on all repositories?

Or at least for a Dockerhub specific integration it'd be nice.

I frequently find myself building Docker images in Codespaces and the only options to get them pushed to my hub account are:

• Go through settings again, and fill in the same credentials for the new repo
• Use docker image save and download the output from the browser, then load it into my local Docker and re-tag + upload it from there

It's probably not a big deal for folks that has a few repos but if you do a lot of random OSS stuff it's a minor annoyance that adds up =(

[thoughtfuldata]

I'm having an issue where it says:

Error: Command failed: docker inspect --type image *******
    at fie (/usr/lib/node_modules/@microsoft/vscode-dev-containers-cli/dist/spec-node/devContainersSpecCLI.js:1915:1355)
{"outcome":"error","message":"Command failed: docker inspect --type image ******","description":"An error occurred setting up the container."}
    at P7 (/usr/lib/node_modules/@microsoft/vscode-dev-containers-cli/dist/spec-node/devContainersSpecCLI.js:1915:1291)
    at processTicksAndRejections (internal/process/task_queues.js:95:5)
    at async Fie (/usr/lib/node_modules/@microsoft/vscode-dev-containers-cli/dist/spec-node/devContainersSpecCLI.js:1921:2093)
    at async $f (/usr/lib/node_modules/@microsoft/vscode-dev-containers-cli/dist/spec-node/devContainersSpecCLI.js:1921:3239)
    at async eoe (/usr/lib/node_modules/@microsoft/vscode-dev-containers-cli/dist/spec-node/devContainersSpecCLI.js:2045:17247)
    at async Qse (/usr/lib/node_modules/@microsoft/vscode-dev-containers-cli/dist/spec-node/devContainersSpecCLI.js:2045:16993)
devcontainer process exited with exit code 1
Failed to create container.
Error: Command failed: docker inspect --type image *********
Error Code: 1302
Container creation failed.
Jobs failed, exiting the agent. Error Code: 1302

I already checked and verified the three secrets( it works when I set the secrets on the repo level)

Some debugging on my end shows that it works when I set the secrets on the repository level, but not on the user level. Yes, access has already been granted to the repo

[Chuxel]

//cc @joshspicer

[thoughtfuldata]

Such a hassle; I have to set these 3 secrets on each repo.