Deploying docker container instance fails to access private docker hub repositry

Question

I have an image in a private docker repository that I want to deploy as a container instance in azure. Everytime I attempt to deploy the instance I get "BadRequest" error message, and the details below say that the image is not accessible.

I am positive my login credentials are correct, as I can login online and with docker login command. I can see the pull requests go up in dockerhub as well.

Using azure portal and azure cli I get the same results, no change.

Raw error: { "code": "DeploymentFailed", "message": "At least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/DeployOperations for usage details.", "details": [ { "code": "InaccessibleImage", "message": "The image 'XXX/XXX' in container group 'XXX' is not accessible. Please check the image and registry credential." } ] }

{"code":"DeploymentFailed","message":"At least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/DeployOperations for usage details.","details":[{"code":"InaccessibleImage","message":"The image 'XXX/XXX' in container group 'XXX' is not accessible. Please check the image and registry credential."}]}

"status": "Failed", "error": { "code": "InaccessibleImage", "message": "The image 'XXX/XXX:latest' in container group 'XXX' is not accessible. Please check the image and registry credential." } }

Answer 1

@Steven Fairchild

The error means there is issue either the image is not there or the credential is not correct for the docker repo. It could also mean missing tag in Image field.
Can you look into the ACI events and see if you find some more information on the error?

To isolate the issue, can you please try to create container from docker command and login with same credential and parameter you are using in ACI ?
can you please try to add tag latest to the image like :latest or :v1

To deploy to ACI from a private Docker Hub repository, the Image registry login server must be index.docker.io.

Here is a similar issue for your reference that can help troubleshoot.

Few other References:

https://blog.codeinside.eu/2018/11/12/howto-run-a-docker-container-using-azure-container-instances/
https://medium.com/[@](/users/na/?userId=9db754fb-0000-0003-0000-000000000000)/having-a-docker-container-as-your-private-npm-registry-the-easy-way-68159fa94cc4

Hope this information is helps in solving your issue.

Please 'Accept as answer' if it helped, so that it can help others in the community looking for help on similar topics.

Disclaimer: This response contains a reference to a third party World Wide Web site.
Microsoft is providing this information as a convenience to you. Microsoft does not control these sites and has not tested any software or information found on these sites; therefore, Microsoft cannot make any representations regarding the quality, safety, or suitability of any software or information found there.

Answer 2

I had the same issue with GitHub docker images built using docker/build-push-action

Changing to docker/build-push-action@v4 and settings provenance: false fixed it for me!

- name: Build and push Docker image
        id: build-and-push
        uses: docker/build-push-action@v4
        with:
          context: .
          push: ${{ github.event_name != 'pull_request' }}
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max
          provenance: false

Answer 3

Thank you for specifying the login server. I have been specifying the tag :latest which is the only tag in use.
I was using a different address before, however the problem still persists. Below is my shell showing that I can log into my docker repository and successfully pull the private image.

I've also posted screenshots showing my azure portal configuration that is failing.

   bash  
   [steven@hostname]$ docker login index.docker.io  
   Username: steve51516  
   Password:   
   Login Succeeded!  
   [steven@dell-inspiron john]$ docker images  
   REPOSITORY                           TAG            IMAGE ID      CREATED       SIZE  
   localhost/steve51516/nginx-jzmotors  latest         76e2f0d635e3  2 days ago    105 MB  
   [steven@hostname]$ docker pull steve51516/nginx-jzmotors  
   Completed short name "steve51516/nginx-jzmotors" with unqualified-search registries (origin: /etc/containers/registries.conf)  
   Trying to pull registry.fedoraproject.org/steve51516/nginx-jzmotors:latest...  
     manifest unknown: manifest unknown  
   Trying to pull registry.access.redhat.com/steve51516/nginx-jzmotors:latest...  
     name unknown: Repo not found  
   Trying to pull registry.centos.org/steve51516/nginx-jzmotors:latest...  
     manifest unknown: manifest unknown  
   Trying to pull docker.io/steve51516/nginx-jzmotors:latest...  
   Getting image source signatures  
   Copying blob ad3ef0859492 skipped: already exists    
   Copying blob 1d7c87af3754 skipped: already exists    
   Copying blob 0a6724ff3fcd skipped: already exists    
   Copying blob e81a2f5037c1 skipped: already exists    
   Copying blob 9668ffa91d19 skipped: already exists    
   Copying blob 991b5ddb4d9e skipped: already exists    
   Copying blob ecc47cb634b6 skipped: already exists    
   Copying blob ad00c6af94df skipped: already exists    
   Copying blob f2f74564b943 skipped: already exists    
   Copying blob 6f28ad4b523d [--------------------------------------] 0.0b / 0.0b  
   Copying config 76e2f0d635 done    
   Writing manifest to image destination  
   Storing signatures  
   76e2f0d635e33f387e69c20d4b33f4e89068a37047646e27fba12a710c225181  
   [steven@hostname]$  

Answer 4

any resolution for this am having the same issue

Answer 5

any updates to this?

This happens when I use a VM in the Virtual Network of the ACR. Th only way to get it deployed is to reset the networking to allow All networks which seems to defeat the purpose of having the repo private endpointed and protected from unauthorized networks