Azure Container Registry in Azure Web App for Containers across subscriptions

Question

I'm currently trying to set up an Azure Web App for Containers, linking it to a Azure Container Registry that lives inside a different subscription. That's why my initial thought was to use the Private Registrytab inside the Web apps Container Settings to enter the credentials of said Registry.

However when I save and reload the page the settings of the Azure Container Registry tab are now populated and the Private Registry tab is empty. The issue is, that I get now get following error:

2020-01-21 21:51:12.951 ERROR - DockerApiException: Docker API responded with status code=NotFound, response={"message":"pull access denied for cliswebapi, repository does not exist or may require 'docker login': denied: requested access to the resource is denied"}

I assume because no password was stored. How do I configure this properly?

Fogy

Answer 1

While you use the private registry, the Azure Container Registry is also a private registry, and deploy to Web App for Containers, you need to set the environment variables here:

• DOCKER_REGISTRY_SERVER_USERNAME - The username for the ACR server.
• DOCKER_REGISTRY_SERVER_URL - The full URL to the ACR server. (For example, https://my-server.azurecr.io.)
• DOCKER_REGISTRY_SERVER_PASSWORD - The password for the ACR server.

See more details in If you're using Azure Container Registry, you need to set some app settings.

And if you create multiple containers, all the images must be in the same registry. All in Docker Hub or Azure Container Registry. See more details in All images must use the same registry.

Update:

With the message that you deploy the Web App using the image in the ACR in a different subscription. It seems it's a bug in Web App and you can see the issue in the Github. And the suggestion is that maybe you can use the service principal for the ACR to authenticate and the steps here.

Chaffee

It seems these values get auto-populated when I enter them through the Private Registry tab. Still, getting the same error. Do I need to do anything on the Container Registry besides enableing the admin user? – Fogy

@Fogy Do you use the service principal to authenticate if you do not enable the admin user? And do you deploy it in the portal? – Chaffee

@Fogy Id you do not use the service principal, I will say yes, you need to enable the admin user to provide the username and password to the Web App. – Chaffee

I'm not using a service principal and I have admin enabled, but still seeing this issue. – Fogy

@Fogy Do you redeploy your image after enabling the admin user? And do you use a single image or multiple images? And do you check if the value of the environment variables in my answer is the same with your ACR? – Chaffee

I enabled the admin user when creating the ACR. It's just a single image which I tried to redeploy using a newer build / tag. I also checked that the values in the config are correct. – Fogy

@Fogy How do you deploy the image into Web App? In the ACR and deploy it? – Chaffee

I deploy it from Azure DevOps into ACR and then wanted to manually get it in the Web App from ACR. Btw. I recreated the ARC instance inside the same subscription and it works immediately. Still, I need to be able to do this across subs. – Fogy

@Fogy Not sure, but it seems it's a bug here in GitHub. Maybe you can use the service principal to authenticate, the steps here. – Chaffee

That's exactly what I'm experiencing. I'll keen an eye out for this to be resolved. Thanks for your help! – Fogy

@Fogy Well, if you do not mind, please accept the answer. – Chaffee

Please add the links to the bug & workaround to your answer since that's the important part. :) – Fogy

@Fogy Update the answer with the link. – Chaffee

Answer 2

I have spend some time on this issue and figured it out. Here is my solution:

Assuming we are having two subscriptions, let's call them SUB-A and SUB-B, where we are having an Azure Container Registry in SUB-A (called azurebluedev in my example).

Now we'd like to create an App Service in SUB-B that pulls its image of our container registry by using the admin username.

It's critical that you use the correct format under Image and tag in the docker blade when creating the app service. It must follow the format url/image:tag (without https) otherwise you will run into the described problem. I was using image:tag format beforehand which didn't work.

This worked for me!

Agrippina

This solved my issue, which was just a 404 NotFound error rather than an authentication error. – Ashcroft