Private ACR Registry - Error: 401

[lBowlin]

Hi all,
I'm working through authoring my first porter bundle and I have hit a snag when I attempt to install my newly created bundle. When I attempt to install or explain the bundle on my Mac it works great, when I attempt the same on a fresh Azure Linux VM it fails with a 401 Unauthorized. The bundle is hosted on a private Azure Container Registry. I have successfully performed a docker login, and can pull images related to the bundle without issue. I is only the porter install/explain step that fails.

porter explain --force -r myregistry.azurecr.io/myorg/myapp:v0.1.1
Error: unable to pull bundle before invoking explain command: unable to pull bundle myregistry.azurecr.io/myorg/myapp:v0.1.1: unable to pull remote bundle: failed to resolve bundle manifest "myregistry.azurecr.io/myorg/myapp:v0.1.1": failed to authorize: failed to fetch anonymous token: unexpected status: 401 Unauthorized

Apologies if this is a rookie mistake, any suggestions would be appreciated!

[carolynvs]

@squillace Do you have any ideas on why accessing a private ACR registry is failing when running Porter inside an azure linux VM?

[squillace]

@lBowlin it works fine for me; how did you originally log into ACR? Just doing the due diligence, but you have to docker login (or az acr login) first to cache your docker creds and then it works according to the permissions you have in the repository. Do you have the appropriate perms, and have you logged in, and if so, how?

[lBowlin]

@squillace on that host I have tried both docker login, and az acr login authing as the admin user (to ensure I have complete perms). Both login types work, and I can docker pull images including the -installer image from that registry without issue. It only seems to struggle with the manifest artifact. I can neither docker pull the manifest, nor run a porter install/explain.

[squillace]

when, precisely, were you doing this work? Yesterday, ACR seemed to suffer an issue with publishing porter bundles and had some log in issues for me for about two hours. have you deleted everything there, reauthed, and tried publishing again? I know you probably have, but I gotta make sure.

[lBowlin]

@squillace I just deleted and republished the bundle (12:20PM PT 7/29) and it still did not work.

[squillace]

I'm baffled. Can you share the repro for me? How'd you create the registry, anything special? just so I can try the entire thing...

[lBowlin]

Sure, it is quite baffling. I cloned https://github.com/getporter/porter/blob/main/examples/hello/porter.yaml and then ran:
porter build --version 0.1.0 --name hello-porter
porter publish --tag 0.1.0 --registry my-acr-repo.azurecr.io

And then on azure VM I run:
porter explain -r my-acr-repo.azurecr.io/hello-porter:0.1.0

Error: unable to pull bundle before invoking explain command: unable to pull bundle .azurecr.io/hello-porter:0.1.0: unable to pull remote bundle: failed to resolve bundle manifest "my-acr-repo.azurecr.io/hello-porter:0.1.0": failed to authorize: failed to fetch anonymous token: unexpected status: 401 Unauthorized

[carolynvs]

This may just be a copy/paste error but I notice that in your latest output that the user isn't set on your ACR registry

unable to pull bundle .azurecr.io/hello-porter:0.1.0

Notice the repository is .azurecr.io/hello-porter without the username. I'm not sure if that's a fluke from when you re-ran it to get us logs, or if that is part of the problem?

[lBowlin]

Ah I see what happened. I anonymized the repo name and replaced with < my-app-repo > and the chevrons triggered a formatting issue that made it disappear. I've edited for clarity.

[squillace]

@lBowlin did it work in the end, or not?

[lBowlin]

No it did not work. Even with the clean bundle build it failed with the same message.

[lBowlin]

I just created a completely fresh ACR (standard tier) and published the hello-porter bundle. It still works locally but fails on the Azure VM.

[lBowlin]

For kicks I tried publishing the bundle from the VM itself and received the same auth error. It appears that Docker can auth properly, but Porter related commands cannot.

[squillace]

Strangely, we just use docker under the hood, nothing fancy there. But SOMETHING is going on....

[carolynvs]

Is the docker login command happening as the same user that is running porter? We really do just use the docker cli library under the hood, so as long as they are both saving/reading auth data to the same location, it should work.

[squillace]

az acr create --sku Standard -n frederick -g registry

╭─squillace at dellsquill in ~/work/squillace/porter/examples/hello on main✘✘✘
╰─± porter build
Copying porter runtime ===>
Copying mixins ===>
Copying mixin exec ===>
Generating Dockerfile =======>
Writing Dockerfile =======>
Starting Invocation Image Build (getporter/porter-hello-installer:v0.1.1) =======>

and then this is correct, as I haven't logged into the private repo:

╭─squillace at dellsquill in ~/work/squillace/porter/examples/hello on main✘✘✘
╰─± porter publish --tag 0.1.0 --registry frederick.azurecr.io
Pushing CNAB invocation image...
The push refers to repository [frederick.azurecr.io/porter-hello-installer]
267c438bc4f4: Preparing
10408d8a4c0d: Preparing
98f1739f9b11: Preparing
ab6bd56aada7: Preparing
1cfaa6a2e74a: Preparing
5f682eac6c77: Preparing
5f682eac6c77: Waiting
Error: unable to push CNAB invocation image "frederick.azurecr.io/porter-hello-installer:0.1.0": failed to stream docker push stdout: unauthorized: authentication required, visit https://aka.ms/acr/authorization for more information.

so then I log in:
az acr login -n frederick

and suddenly:

╭─squillace at dellsquill in ~/work/squillace/porter/examples/hello on main✘✘✘
╰─± porter publish --tag 0.1.0 --registry frederick.azurecr.io
Pushing CNAB invocation image...
The push refers to repository [frederick.azurecr.io/porter-hello-installer]
267c438bc4f4: Preparing
10408d8a4c0d: Preparing
98f1739f9b11: Preparing
ab6bd56aada7: Preparing
1cfaa6a2e74a: Preparing
5f682eac6c77: Preparing
5f682eac6c77: Waiting
10408d8a4c0d: Pushed
98f1739f9b11: Pushed
1cfaa6a2e74a: Pushed

so it's working....

[squillace]

so there's something you are doing wrt to the creation of the acr or when using it from a vm.

[lBowlin]

I just spun up a fresh VM and it worked successfully. This time I installed Docker with apt instead of snap and that may have something to do with it. Both times docker and porter were running as my normal user, but I'm wondering if the snap sandboxing gets in the way of sharing the auth with porter. If I get time I will retest with snap to confirm. Thank you all so much for your help.

[carolynvs]

Phew! I'm glad you got it figured out. 👍 Thanks for sharing the answer.