Docker Push to Azure Container Registry: Access Denied

Question

I'm trying to push images to an instance of Azure Container Registry but it keeps failing even though I have logged in successfully.

Garwin

Answer 1

The tag needs to be:

azure_registry_name.azurecr.io/container-name:tag

in my case:

docker push sunlabregistry.azurecr.io/python

Garwin

I've written a full example on using Microsoft Azure Container Registry with the SDK CLI where you can tag your container image and push it upstream. docker tag container-name sunlabregistry.azurecr.io/container-name:tag and docker push acidemomvp.azurecr.io/aci-tutorial-app:v1 The rest is all explained in my step-by-step tutorial. – Mccollough

worked properly, thanks. Just a side note, if you have come here after reading to use sudo, it works as a normal user too. – Moulden

This worked great. You have to fully qualify the container registry name. You get hints that docker.io is the container registry which is default in use if you skip the domain name of the container registry in Azure. Which should be azurecr.io instead. – Embolus

The documentation on the "push a container image" azure page doesn't mention using the full url so I was quite frustrated trying to figure out what was going on. – Howe

Answer 2

Building on the response from Batman. In my case, I needed to follow the steps described here:

https://learn.microsoft.com/en-us/azure/container-registry/container-registry-repository-scoped-permissions

In particular, the name of the container cannot be any name we want. It needs to match the name of the repository which we have indicated when we created the "Scope map" in our container registry. To make it more concrete, let's list all the steps from creating the container registry up to doing "docker push":

1. Create a "Container Registry", and copy the "Login server", which in the example given by Batman is sunlabregistry.azurecr.io, but I use the name my_registry.azurecr.io

2. In this Container Registry, create a "Token".

3. When creating the Token, we have a field called "Scope map". Click on "Create new"

4. We will get a window where we have text fields "Repository" and "Permissions". We can indicate any name we want in the text field "Repository". Let this name be my_repository. In the permissions, I selected all, which includes content/read, content/write.

5. Once the Scope map has been created, we can finally generate our "Token". In the token details, select password1 or password2, and select the Generate icon.

6. After generating a password, copy and save it to a safe location. Azure let's you copy the full docker login command with the password included, something like:

   docker login -u MyToken -p my_password my_registry.azurecr.io
   

7. Do docker login with the above command (maybe adding "sudo" at the beginning)

8. Tag your image as follows:

   sudo docker image tag <container_id> 
   my_registry.azurecr.io/my_repository:my_version
   

   where my_version can be anything we want, but my_repository needs to match what we entered when creating the Token, in step 4 above.

9. Push the tagged image as follows:

sudo docker push my_registry.azurecr.io/my_repository:my_version

Enameling

Answer 3

First you have tag your local images with sunlabregistry.azurecr.io/python-app:v1 then use docker push /python-app:v1 tag should be mentioned.

Porthole

Answer 4

In my case I faced the error when I tried to publish from visual studio ide to the Azure container registery. Reason the user didn't had AcrPush role, after assigning the role I was able to publish. This can be done through portal as well as CLI. Hope this helps some one

Through portal -

In your ACR's blade (left-hand menu), click on "Access Control (IAM)". Click on "+ Add" > "Add role assignment". The "Add role assignment" pane will open on the right.

In the "Role" dropdown, select AcrPush to allow the user to push images to the registry. If the user also needs to pull images, you might consider assigning AcrPushPull role instead.

Galenical