Credentials error when using a common docker asset as base image for other docker assets

[jogold]

Using a common docker asset as base image for other docker assets can lead to credentials error when building.

If the common docker asset already exists docker build and docker login will be skipped. When building the docker asset that uses the common docker asset as base image docker build will fail because it won't be able to pull the base image.

The fix is simple: always call docker login before calling docker build.

Reproduction Steps

Consider the following pattern to "reuse" a common docker asset as base image in other docker assets:

/**
 * A construct that creates a common docker asset that can be used
 * in multiple stacks as base image
 */
class CommonDockerAsset extends cdk.Construct {
  public readonly imageTag: string;

  constructor(scope: cdk.Construct, id: string) {
    super(scope, id);

    const asset = new assets.DockerImageAsset(this, 'Image', {
      directory: path.join(__dirname, '../common-docker'),
    });

    this.imageTag = asset.sourceHash;
  }
}

# Dockerfile for asset in StackA that should use the common docker
# asset as base image
ARG TAG
FROM 123456789012.dkr.ecr.eu-west-1.amazonaws.com/aws-cdk/assets:$TAG

COPY ...

/**
 * Use it in StackA and pass TAG as build arg
 */
class StackA extends TaggedStack {
  constructor(scope: cdk.Construct, id: string) {
    super(scope, id);

    const commonDockerAsset = new CommonDockerAsset(this, 'CommonDockerAsset');
    const taskDefinition = new ecs.FargateTaskDefinition(this, 'TaskDef');
    taskDefinition.addContainer('Container', {
      image: ecs.ContainerImage.fromAsset(path.join(__dirname, '../stack-docker'), {
        buildArgs: { TAG: commonDockerAsset.imageTag },
      }),
    });
  }
}

Error Log

The error no basic auth credentials is returned on docker build if the docker asset in StackA has changed but not the common docker asset.

Environment

• CLI Version : 1.25.0
• Framework Version: 1.25.0
• OS : all
• Language : all

---

This is 🐛 Bug Report

[jogold]

@rix0rrr this pattern is not perfect since the account id and region are tokens meaning that you cannot use them in FROM 123456789012.dkr.ecr.eu-west-1.amazonaws.com/aws-cdk/assets:$TAG but it works by manually setting those values and I'm using it.

I think that the build order is preserved and if not you can make a stack instead of a construct for the common docker asset. The stack will be empty but will always be processed before the consuming stacks.