Aws-codebuild-docker-images: cannot loign to Amazon ECR on ubuntu/docker/17.09.0 image built by myself

[vroad]

I've tried building both master and 1.2.0.0, none of them let me login to ECR on CodeBuild.
If I use official docker image from Amazon instead, the same command succeeds without errors.
Am I missing something?

15:55:20
[Container] 2018/03/22 06:55:17 Running command $(aws ecr get-login --no-include-email)
15:55:20
WARNING! Using --password via the CLI is insecure. Use --password-stdin.
15:55:20
Warning: failed to get default registry endpoint from daemon (Cannot connect to the Docker daemon at unix:///var/run/docker.sock. Is the docker daemon running?). Using system default: https://index.docker.io/v1/
15:55:20
Cannot connect to the Docker daemon at unix:///var/run/docker.sock. Is the docker daemon running?
15:55:20
15:55:20
[Container] 2018/03/22 06:55:18 Command did not exit successfully $(aws ecr get-login --no-include-email) exit status 1
15:55:20
[Container] 2018/03/22 06:55:18 Phase complete: PRE_BUILD Success: false
15:55:20
[Container] 2018/03/22 06:55:18 Phase context status code: COMMAND_EXECUTION_ERROR Message: Error while executing command: $(aws ecr get-login --no-include-email). Reason: exit status 1

[clareliguori]

Hi @vroad, Based on the logs, it looks like the Docker daemon is not starting up. Have you enabled the "privileged" flag in your CodeBuild project to enable Docker to start up? That is implicitly done for you when using the CodeBuild official Docker 17.09 image, but not with ECR images.

[vroad]

Thanks for the response. That might be the cause of the issue. I haven't checked privileged flag when I created the project.
I don't have much time to try using my image again now, though. If that doesn't fix my issue when I try this again, I'll reopen the issue.

[ricardojohnny]

This status code usually indicates an unauthorized user. To fix this, we need to let our Code Build role be able to talk to ECR. To do this: Go to IAM and then attach a AmazonEC2ContainerRegistryPowerUser policy to your CodeBuild role.

[verma1997]

@ricardojohnny can you please elaborate the steps more.

[logemann]

i get this error even after applying:

pipelineProject.addToRolePolicy(new PolicyStatement({resources: ["*"], actions: ["ecr:*"], effect: Effect.ALLOW}));

which should be a superset of AmazonEC2ContainerRegistryPowerUser.

UPDATE for CDK users running into this. As @clareliguori mentioned, the privilege flag is the thing to watch out for. In CDK you can easily activate it via:

environment: {
                buildImage: codebuild.LinuxBuildImage.UBUNTU_14_04_OPEN_JDK_8, 
                privileged: true
            },

as part of your PipelineProject properties. You you definitely need to expand the policies added to the default Codepipeline Role which CDK creates. To limit those privileges a bit (compared to the wildcard which i mentioned before) you an also use:

pipelineProject.role?.addManagedPolicy(ManagedPolicy.fromAwsManagedPolicyName('AmazonEC2ContainerRegistryPowerUser'));