Azure Container Registry
This document contains important notes from GQC's exploration into Azure Container Registry (ACR) for privately hosting docker images on the web.
Environment and Prerequisites
All of this work is done inside WSL. I have not tested in Windows.
Login ACR in Development Environment
# ######################
# Define variables
RES_GROUP=gqc-containers_rg
ACR_NAME=gqccontainers
# ######################
# Login to the tenant
az login --tenant 0f5b016b-1dd9-41b1-b761-cea5e8091a03
# Login to the ACR
az acr login --name $ACR_NAME
Login ACR in Production with Service Principal
container-registry-auth-service-principal
NOTE - The scripts in the linked instructions do NOT work from WSL. This is a known issue as documented in Azure CLI Issue 28159.
Since WSL doesn't work, I will try running commands in the cloud bash.
Cloud Shell
I got a different (more promising) error when running the Service Principal script in cloud shell:
WARNING: Found an existing application instance: (id) c4c5dd17-77b4-49f2-b9b5-5f829b814178. We will patch it.
WARNING: Creating 'acrpull' role assignment under scope '/subscriptions/68a75dc2-5bb3-4c18-a206-211c3dd65257/resourceGroups/gqc-containers_rg/providers/Microsoft.ContainerRegistry/registries/gqccontainers'
WARNING: Role assignment creation failed.
WARNING: role assignment response headers: {'Cache-Control': 'no-cache', 'Pragma': 'no-cache', 'Content-Length': '574', 'Content-Type': 'application/json; charset=utf-8', 'Expires': '-1', 'x-ms-failure-cause': 'gateway', 'x-ms-request-id': '6daeccca-4104-4882-82ec-5189de9e70bf', 'x-ms-correlation-request-id': '6daeccca-4104-4882-82ec-5189de9e70bf', 'x-ms-routing-request-id': 'EASTUS:20240710T154641Z:6daeccca-4104-4882-82ec-5189de9e70bf', 'Strict-Transport-Security': 'max-age=31536000; includeSubDomains', 'X-Content-Type-Options': 'nosniff', 'X-Cache': 'CONFIG_NOCACHE', 'X-MSEdge-Ref': 'Ref A: 728DAA9286F940738F8C832CAAE09E07 Ref B: BL2AA2010201021 Ref C: 2024-07-10T15:46:41Z', 'Date': 'Wed, 10 Jul 2024 15:46:41 GMT'}
ERROR: (AuthorizationFailed) The client 'live.com#jacob@gqc.com' with object id '7f8e4642-7dee-4291-b8f7-9cc004e943fb' does not have authorization to perform action 'Microsoft.Authorization/roleAssignments/write' over scope '/subscriptions/68a75dc2-5bb3-4c18-a206-211c3dd65257/resourceGroups/gqc-containers_rg/providers/Microsoft.ContainerRegistry/registries/gqccontainers/providers/Microsoft.Authorization/roleAssignments/a930303f-064b-4437-b1d0-63d93868fb7e' or the scope is invalid. If access was recently granted, please refresh your credentials.
Code: AuthorizationFailed
Message: The client 'live.com#jacob@gqc.com' with object id '7f8e4642-7dee-4291-b8f7-9cc004e943fb' does not have authorization to perform action 'Microsoft.Authorization/roleAssignments/write' over scope '/subscriptions/68a75dc2-5bb3-4c18-a206-211c3dd65257/resourceGroups/gqc-containers_rg/providers/Microsoft.ContainerRegistry/registries/gqccontainers/providers/Microsoft.Authorization/roleAssignments/a930303f-064b-4437-b1d0-63d93868fb7e' or the scope is invalid. If access was recently granted, please refresh your credentials.
Service principal ID: b2b5e302-b231-43bd-9255-3318da53486d
Service principal password:
Build, Tag, and Push Images to Registry
# ######################
# Build the images
docker compose build
# ######################
# Tag the images
# Latest - DON'T USE THIS ONE, USE YOUR ARCHITECTURE!
docker tag deepvibe-super-repo-react gqccontainers.azurecr.io/gqc/deepvibe-frontend-react
docker tag deepvibe-super-repo-django gqccontainers.azurecr.io/gqc/deepvibe-api-drf
docker tag deepvibe-super-repo-socket-app gqccontainers.azurecr.io/gqc/deepvibe-socket-app
# amd64
docker tag deepvibe-super-repo-react gqccontainers.azurecr.io/gqc/deepvibe-frontend-react:amd64
docker tag deepvibe-super-repo-django gqccontainers.azurecr.io/gqc/deepvibe-api-drf:amd64
docker tag deepvibe-super-repo-socket-app gqccontainers.azurecr.io/gqc/deepvibe-socket-app:amd64
# arm64/aarch64
docker tag deepvibe-super-repo-react gqccontainers.azurecr.io/gqc/deepvibe-frontend-react:arm64
docker tag deepvibe-super-repo-django gqccontainers.azurecr.io/gqc/deepvibe-api-drf:arm64
docker tag deepvibe-super-repo-socket-app gqccontainers.azurecr.io/gqc/deepvibe-socket-app:arm64
# ######################
# Push the images
# Latest - DON'T USE THIS ONE, USE YOUR ARCHITECTURE!
docker push gqccontainers.azurecr.io/gqc/deepvibe-frontend-react
docker push gqccontainers.azurecr.io/gqc/deepvibe-api-drf
docker push gqccontainers.azurecr.io/gqc/deepvibe-socket-app
# amd64
docker push gqccontainers.azurecr.io/gqc/deepvibe-frontend-react:amd64
docker push gqccontainers.azurecr.io/gqc/deepvibe-api-drf:amd64
docker push gqccontainers.azurecr.io/gqc/deepvibe-socket-app:amd64
# arm64/aarch64
docker push gqccontainers.azurecr.io/gqc/deepvibe-frontend-react:arm64
docker push gqccontainers.azurecr.io/gqc/deepvibe-api-drf:arm64
docker push gqccontainers.azurecr.io/gqc/deepvibe-socket-app:arm64
# ######################
# Manifest? See next section "Multi-arch images"
Multi-arch images
# ######################
# deepvibe-frontend-react
docker manifest create gqccontainers.azurecr.io/gqc/deepvibe-frontend-react:latest \
gqccontainers.azurecr.io/gqc/deepvibe-frontend-react:arm64 \
gqccontainers.azurecr.io/gqc/deepvibe-frontend-react:amd64
docker manifest push --purge gqccontainers.azurecr.io/gqc/deepvibe-frontend-react:latest
# ######################
# deepvibe-api-drf
docker manifest create gqccontainers.azurecr.io/gqc/deepvibe-api-drf:latest \
gqccontainers.azurecr.io/gqc/deepvibe-api-drf:arm64 \
gqccontainers.azurecr.io/gqc/deepvibe-api-drf:amd64
docker manifest push --purge gqccontainers.azurecr.io/gqc/deepvibe-api-drf:latest
# ######################
# deepvibe-socket-app
docker manifest create gqccontainers.azurecr.io/gqc/deepvibe-socket-app:latest \
gqccontainers.azurecr.io/gqc/deepvibe-socket-app:arm64 \
gqccontainers.azurecr.io/gqc/deepvibe-socket-app:amd64
docker manifest push --purge gqccontainers.azurecr.io/gqc/deepvibe-socket-app:latest