Using ACR across subscriptions with Web App for Containers fails

Question

I'm unable to get a docker image from ACR in app service that lives in a different subscription.

To Reproduce

1. Create ACR in one subscription, add container
2. Add Web App for Containers in another subscription
3. Since the ACR won't show up in the Web App dropdown menu, enter connection details in private registry tab and save
4. Exit and re-enter container settings
5. The settings were moved to the Azure Container Registry tab and are not working => no image is being deployed

Expected behavior

The settings should stay in the private registry tab and a container should be pulled from ACR.

Setting the DOCKER_REGISTRY_SERVER_URL, DOCKER_REGISTRY_SERVER_USERNAME & DOCKER_REGISTRY_SERVER_PASSWORD values in the app config directly does not work.

Any relevant environment information

• Azure Portal

Additional context

Issue is also being discussed here https://github.com/Azure/acr/issues/345 and here https://github.com/microsoft/vscode-docker/issues/743

Answer 1

@ryanchill

2020-06-10T18:27:04.660Z ERROR - DockerApiException: Docker API responded with status code=InternalServerError, response={"message":"Get https://xxxxxxx.azurecr.io/v2/xxxxxxx: unauthorized: authentication required"}

is seen.

And yeah the URL, username, and password supplied should all be working.

Answer 2

@Thomas Pentenrieder , can you share a screen shot showing what you configured manually in the Private Registry pane? (Send email to jennylaw(at)microsoft.com, with any additional details.

Answer 3

Ist there any solution for that? I got the same and I just dont find a solution

2021-03-27T20:59:05.912Z INFO - Pulling image from Docker hub: xxxxxx.azurecr.io/node-docker-demo:latest
2021-03-27T20:59:06.197Z ERROR - DockerApiException: Docker API responded with status code=InternalServerError, response={"message":"Get https://stefTestReg.azurecr.io/v2/node-docker-demo/manifests/latest: unauthorized: authentication required, visit https://aka.ms/acr/authorization for more information."}

So docker pull to the local machine works. So the xxxxxx.azurecr.io/node-docker-demo:latest repo is ok.

Has this something to do wiht the az command
az role assignment create --assignee ....

??
So I try to make the https://learn.microsoft.com/en-us/azure/app-service/tutorial-custom-container?pivots=container-linux
happening. So ok fixed the outdated image and replaced it b node-docker-demo. But then I got this error can not get further

Answer 4

If anyone comes accross this, the fix is mentioned here:

https://github.com/Azure/acr/issues/345

in short, you must use the container registry url when defining the image name

ping @Dr. Stefan Werden | MCM

Answer 5

Thank you for your answer. Yes, in the mean time I made it work. As far as I remember this was one of the things:

• The solution you mentioned
• A typo in the registry name
• Or forgot to do a "az arr login registry" on the azure cli

Thank you very much for taking answering,

Stefan