When I setup my container app job within my container app environment I get the following error: Failed to retrieve images for ACR 'acr.azurecr.io'. This may be due to network isolation being enabled on the ACR. Please manually enter the image and tag below. My ACR has a private endpoint via Private DNS Zone and my container app environment has a subnet with the same NSG and UDR as the ACR. Even when I deploy my container app job vir ARM template I get this message: The following field(s) are either invalid or missing. Field 'template.containers.ten-gigbyte.image' is invalid with details: 'Invalid value: "acr.azurecr.io/2gbnew2:latest": GET https:?scope=repository%3A2gbnew2%3Apull&service=acr.azurecr.io: unexpected status code 403 Forbidden';. (Code:InvalidParameterValueInContainerTemplate) My managed identity has all the required permissions for the container app job to pull the image from the ACR. I tested my network connection from my VM to my ACR(same VNET) and we get a response.

Getting error when I create container app job in my container app environment

Heinrich 0

When I setup my container app job within my container app environment I get the following error:

Failed to retrieve images for ACR 'acr.azurecr.io'. This may be due to network isolation being enabled on the ACR. Please manually enter the image and tag below.

My ACR has a private endpoint via Private DNS Zone and my container app environment has a subnet with the same NSG and UDR as the ACR.

Even when I deploy my container app job vir ARM template I get this message:

The following field(s) are either invalid or missing. Field 'template.containers.ten-gigbyte.image' is invalid with details: 'Invalid value: "acr.azurecr.io/2gbnew2:latest": GET https:?scope=repository%3A2gbnew2%3Apull&service=acr.azurecr.io: unexpected status code 403 Forbidden';. (Code:InvalidParameterValueInContainerTemplate)

My managed identity has all the required permissions for the container app job to pull the image from the ACR.

I tested my network connection from my VM to my ACR(same VNET) and we get a response.

Anveshreddy Nimmala 3,545 Reputation points Microsoft Vendor

2024-06-26T05:45:32.3133333+00:00

Hello Heinrich,

Welcome to microsoft Q&A, thankyou for posting your query here.

The error indicates that acr.azurecr.io/2gbnew2:latest matches the actual image name in your ACR.

Try disabling the Private DNS temporarily on your ACR to see if the issue persists.

Please if possible provide the ARM template you are using.
Heinrich 0 Reputation points

2024-06-26T08:07:17.7066667+00:00

Hi Anveshreddy,

I did disable it and it works, but because we are required to have private endpoint on all our resources we can't disable it.

Here is my ARM template for my ACR:

{

"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#",

"contentVersion": "1.0.0.0",

"parameters": {

"name": {

"value": "acr"

},

"acrAdminUserEnabled": {

"value": true

},

"acrSku": {

"value": "Premium"

},

"privateEndpoints": {

"value": [

{

"privateDnsZoneResourceIds": [

"/subscriptions/xxxxxxxxxxxxx/resourceGroups/xxxxxxxx/providers/Microsoft.Network/privateDnsZones/privatelink.azurecr.io"

],

"name": "xxxxxxxx",

"service": "registry",

"subnetResourceId": "/subscriptions/xxxxxxxxxxxxx/resourceGroups/xxxxxxxxx/providers/Microsoft.Network/virtualNetworks/xxxxxxxxx/subnets/xxxxxxxxxxxxx”

}

]

}

}

}

And here is my main.bicep for my ACR:

param name string

param acrAdminUserEnabled bool

param acrSku string

param privateEndpoints array

param tags object

module containerreg 'br/public:avm/res/container-registry/registry:0.2.0' = {

name: 'DeployContainerRegistry'

params: {

name: name

acrAdminUserEnabled: acrAdminUserEnabled

acrSku: acrSku

privateEndpoints: privateEndpoints

tags: tags

}

}

Anveshreddy Nimmala 3,545 Microsoft Vendor

Hello Heinrich,

Apologies for delay in response, i was checking internally for the cause of the issue.

The issue likely lies with how your ARM template interacts with the private endpoint configuration. It configures a private endpoint for the ACR service using a specified private DNS zone and subnet.

"privateEndpoints": {
      "value": [
        {
          "privateDnsZoneResourceIds": [
            "/subscriptions/<subscription ID>/resourceGroups/<resourcegroup ID>/providers/Microsoft.Network/privateDnsZones/privatelink.azurecr.io"
          ],
          "name": "<Name of registry>",
          "service": "registry",
          "subnetResourceId": "/subscriptions/<subscription ID>/resourceGroups/<resourcegroup ID>/providers/Microsoft.Network/virtualNetworks/<Vnet ID>/subnets/<Subnet ID>"

Updated Bicep Template for ACR with Private Endpoint

param name string
param acrAdminUserEnabled bool
param acrSku string
param privateEndpoints array
param tags object
module containerreg 'br/public:avm/res/container-registry/registry:0.2.0' = {
  name: 'DeployContainerRegistry'
  params: {
    name: name
    acrAdminUserEnabled: acrAdminUserEnabled
    acrSku: acrSku
    privateEndpoints: privateEndpoints
    tags: tags
  }
}

Hope this helps you , please reach us back if the issue not resolved.

Heinrich 0 Reputation points

2024-06-28T07:43:48.3766667+00:00

Hi Anveshreddy,

Yes that is right we dont use any public access, everything goes via private endpoints, so what changes do we need to make on the ACR networking or permissions side for it to work?

Your Json and Bicep is the same as mine on your reply.

Share via

Getting error when I create container app job in my container app environment

Your answer