skaffold: Private base images don't work with skaffold properly
Skaffold cannot pull from private registry. Docker daemon can. OS and docker daemon:
root@debbie:~# uname -a
Linux debbie 4.14.0-3-amd64 #1 SMP Debian 4.14.17-1 (2018-02-14) x86_64 GNU/Linux
root@debbie:~# lsb_release -a
No LSB modules are available.
Distributor ID: Debian
Description: Debian GNU/Linux testing (buster)
Release: testing
Codename: buster
root@debbie:~# docker -v
Docker version 17.12.1-ce, build 7390fc6
root@debbie:~#
Skaffold:
root@debbie:~# skaffold version
v0.2.0
root@debbie:~#
Skaffold output:
dcherniv@debbie:~REDACTED$ skaffold run
Starting build...
Found minikube or Docker for Desktop context, using local docker daemon.
WARN[0000] Could not get minikube docker env, falling back to local docker daemon
Sending build context to Docker daemon 814.1kB
Step 1/22 : FROM REGISTRY/REDACTED/REDACTED:latest
ERRO[0000] run: running skaffold steps: run: build step: running build: unauthorized: The client does not have permission for manifest
Docker output:
dcherniv@debbie:~REDACTED$ docker pull REGISTRY/REDACTED/REDACTED:latest
latest: Pulling from REGISTRY/REDACTED/REDACTED
6d987f6f4279: Pull complete
dab216b6afad: Pull complete
c9580cbb00a7: Pull complete
Digest: sha256:340d53a95a520fb94b4eda1718780bd841a7d8ae484181e700163da75dfd742b
Status: Downloaded newer image for REGISTRY/REDACTED/REDACTED:latest
dcherniv@debbie:~/REDACTED$
After the image is downloaded to local, skaffold run succeeds. Output ommited for brevity.
What gives? my docker config is in ~/.docker/config.json
Auth is base64 encoded:
"auths": {
"https://REGISTRY": {
"auth": "REDACTEDBASE64",
"email": "blah@nah.id"
},
[....]
}
In private docker registry logs i see requests from skaffold coming in as anonymous/unauthenticated, where with docker pull i see the request having a proper username. Private registry is running on artifactory.
About this issue
- Original URL
- State: closed
- Created 6 years ago
- Reactions: 3
- Comments: 27 (17 by maintainers)
Commits related to this issue
- Support private registries at build time Does not support credential helpers yet because it's VERY slow. Related to #239 Signed-off-by: David Gageot <david@gageot.net> — committed to dgageot/skaffold by dgageot 6 years ago
- docker auth: use GetAllCredentials() to use credHelpers The current mechanism for building the map of `AuthConfig` to pass to the docker daemon when building the image bypasses any credsHelpers in th... — committed to mattnworb/skaffold by mattnworb 5 years ago
I can confirm this is happening for me as well with Skaffold v20.0 and a private GCR.
This is still broken for me - built skaffold from master today.
Without local image
Manual pull of image
success with skaffold