Lock container image in ACR using Docker@2 task

Question

Lock container image in ACR using Docker@2 task

OO-6907 0

Took below snippet from a sample code. I want to lock subsequent pushed image tag. Does Docker@2 accepts write-enabled: false as input? If not, how do I achieve this with Docker@2 task?

  - task: Docker@2
    condition: eq('${{ parameters.Pulumi}}', 'True')
    inputs:
      containerRegistry: 'devagents'
      repository: 'dev-test-agent'
      command: 'buildAndPush'
      Dockerfile: '$(System.DefaultWorkingDirectory)/Dockerfile'
      tags: '$(devs-agent-tag)'

vipullag-MSFT 26,537 Reputation points Moderator

2023-07-17T04:31:44.8+00:00
Hello OO-6907

The Docker@2 task in Azure Pipelines does not directly support setting an image as read-only or providing a write-enabled option. However, you can achieve the desired behavior by using the Azure CLI or Azure PowerShell task to execute the required Azure Container Registry commands.

Here's an example of how you can lock the subsequent pushed image tag using the Docker@2 task in combination with the Azure CLI task:

- task: Docker@2 condition: eq('${{ parameters.Pulumi }}', 'True') inputs: containerRegistry: 'devagents' repository: 'dev-test-agent' command: 'buildAndPush' Dockerfile: '$(System.DefaultWorkingDirectory)/Dockerfile' tags: '$(devs-agent-tag)' - task: AzureCLI@2 condition: eq('${{ parameters.Pulumi }}', 'True') displayName: 'Lock container image in ACR' inputs: azureSubscription: 'yourAzureSubscription' scriptType: 'bash' scriptLocation: 'inlineScript' inlineScript: | az acr repository update --name devagents --repository dev-test-agent --tag $(devs-agent-tag) --write-enabled false

In this example, after pushing the container image using the Docker@2 task, an Azure CLI task is used to execute the az acr repository update command. This command updates the repository in the ACR and sets the specified image tag as read-only (--write-enabled false).

Make sure to replace 'devagents', 'dev-test-agent', 'yourAzureSubscription', and $(devs-agent-tag) with your actual values.

By combining the Docker@2 task and the Azure CLI task, you can achieve the desired result of locking the subsequent pushed image tag in the Azure Container Registry.
vipullag-MSFT 26,537 Reputation points Moderator

2023-07-17T04:33:28.0266667+00:00

Hello OO-6907

Azure DevOps related queries/issues are currently not supported on this Microsoft Q&A platform.

I would request you to please post your queries in dedicated forums as in below links:

https://developercommunity.visualstudio.com/spaces/21/index.html

https://developercommunity.visualstudio.com/t/get-unique-id-from-devops-organization/756710

https://stackoverflow.com/questions/tagged/azure-devops

Make sure to replace 'devagents', 'dev-test-agent', 'yourAzureSubscription', and $(devs-agent-tag) with your actual values.

By combining the Docker@2 task and the Azure CLI task, you can achieve the desired result of locking the subsequent pushed image tag in the Azure Container Registry.