Azure-pipelines-tasks: DockerV2 using ACR - unauthorized: authentication required

[lgoncalv]

Required Information

Entering this information will route you directly to the right team and expedite traction.

Question, Bug, or Feature?
Type: here Question

Enter Task Name: DockerV2

list here (V# not needed):
https://github.com/Microsoft/azure-pipelines-tasks/tree/master/Tasks/DockerV2

Environment

• Server: Azure Pipelines
• Agent: Hosted VS2017

Issue Description

Docker task seems to have stopped working, I'm getting unauthorized: authentication required error but the Docker login step seems to be working ok.

Comparing both logs, the one that worked last week and today runs I can see that today's logs are showing the full path of the image name while before used to show */repository:tag

Please see below extract of build file

- stage: Build_and_push_docker_image
  jobs:
  - job: BuildJob
    pool:
     vmImage: 'win1803'
    steps:
    - task: Docker@2
      displayName: Login to ACR
      inputs:
       command: login
       containerRegistry: acrConnection
    - task: Docker@2
      displayName: Build and Push
      inputs:
       command: buildAndPush
       Dockerfile: discounting-app/Dockerfile
       repository: discounting.frontend
       tags: |
         latest
         v$(Build.BuildNumber)

Task logs

Partial logs below

##[debug]tags=latest
v1.0.20190610.6-rc
##[debug]repository=discounting.frontend
##[debug]containerRegistry=null
##[debug]DOCKER_CONFIG=D:\_work\_temp\DockerConfig_1560181940576
##[debug]agent.tempDirectory=D:\_work\_temp
##[debug]Found the Docker Config stored in the temp path. Docker config path: D:\_work\_temp\DockerConfig_1560181940576\config.json, Docker config: {"auths": { "***": {"auth": "***", "email": "ServicePrincipal@AzureRM" } }, "HttpHeaders":{"X-Meta-Source-Client":"VSTS"} }
##[debug]dockerFile=D:\_work\1\s\discounting-app\Dockerfile
##[debug]No pattern found in Docker filepath parameter
##[debug]Pushing ImageNameWithTag: sbukcontainerregistry.azurecr.io/discounting.frontend:latest
##[debug]C:\Program Files\Docker\docker.exe arg: push
##[debug]C:\Program Files\Docker\docker.exe arg: sbukcontainerregistry.azurecr.io/discounting.frontend:latest
##[debug]exec tool: C:\Program Files\Docker\docker.exe
##[debug]Arguments:
##[debug]   push
##[debug]   sbukcontainerregistry.azurecr.io/discounting.frontend:latest
[command]"C:\Program Files\Docker\docker.exe" push sbukcontainerregistry.azurecr.io/discounting.frontend:latest
##[debug]Pushing ImageNameWithTag: sbukcontainerregistry.azurecr.io/discounting.frontend:v1.0.20190610.6-rc
The push refers to repository [sbukcontainerregistry.azurecr.io/discounting.frontend]
36a47b94d65f: Preparing
c194ff6cfc42: Preparing
fe039aa0a5bf: Preparing
da042c660f84: Preparing
9a7536b73870: Preparing
2f0eeaaf4e39: Preparing
bbafc0397559: Preparing
47705f1112f7: Preparing
db27c8df465e: Preparing
4b72d0e6c98a: Preparing
4de80668d45d: Preparing
0c57cbd39c3f: Preparing
1774ad41ac79: Preparing
992f11576297: Preparing
0869fa7c777b: Preparing
5198fe5efc48: Preparing
aafa1d8b8f5b: Preparing
70bba925263c: Preparing
2f0eeaaf4e39: Waiting
bbafc0397559: Waiting
47705f1112f7: Waiting
db27c8df465e: Waiting
4b72d0e6c98a: Waiting
4de80668d45d: Waiting
0c57cbd39c3f: Waiting
1774ad41ac79: Waiting
992f11576297: Waiting
0869fa7c777b: Waiting
5198fe5efc48: Waiting
aafa1d8b8f5b: Waiting
70bba925263c: Waiting
unauthorized: authentication required
##[debug]rc:1
##[debug]success:false
##[debug]task result: Failed
##[error]C:\Program Files\Docker\docker.exe failed with return code: 1
##[debug]Processed: ##vso[task.issue type=error;]C:\Program Files\Docker\docker.exe failed with return code: 1
##[debug]Processed: ##vso[task.complete result=Failed;]C:\Program Files\Docker\docker.exe failed with return code: 1
##[section]Finishing: Build and Push

[ajinkya599]

Hi @lgoncalv, to help us investigate, can you please share the URL of your pipeline ?
Also, which auth type are you using in your Docker registry service connection, and where are you getting the credentials from ?

Also, can you try out the following -

• Create a fresh Docker registry service connection using the credentials obtained from Azure portal (Access keys for your registry).
• Use this in the pipeline and see if it works.

[lgoncalv]

Hi @ajinkya599, I'm using Azure Container Registry type which doesn't require credentials.

I just tried using Others type and it does work if I enable and use admin credentials on the Registry Access Key section, no idea why the Azure Container Registry type doesn't work though.

[ajinkya599]

The issue started happening after this commit in the Docker task.
When the Docker registry service connection is saved with Azure Container Registry type, the endpoint url can contain uppercase characters.

Since the above commit ensures that the image name is always lower-cased for DockerV2 task, it caused a mismatch when the Docker cli tried to read the auth credentials for the registry from the Docker config file. That is what resulted in the authentication failures.

We have fixed the issue with this commit and rolled out a hotfix. It should be working now. Please try it out and let us know.

Thanks for reporting the issue.

[lgoncalv]

Hi @ajinkya599, it is working now.

Thanks for the quick fix!