docker pull failed by "unauthorized"

[azure]

docker pull failed by "unauthorized"

[datamattsson]

In my particular case with OpenShift 3.5 and Docker 1.12.6 from Red Hat I had to add --signature-verification=false to OPTIONS in /etc/sysconfig/docker and restart docker with systemctl restart docker. docker pull from ACR now works as intended. I want to caveat this with that I have no clue what side effects this might have on OpenShift.

[tanaka-takayoshi]

I found docker 17.06.0-ce on RHEL 7.3 can pull an image from the same registry. Could you add the version requirement in the document?

# docker version
Client:
 Version:      17.06.0-ce
 API version:  1.30
 Go version:   go1.8.3
 Git commit:   02c1d87
 Built:        Fri Jun 23 21:20:36 2017
 OS/Arch:      linux/amd64

Server:
 Version:      17.06.0-ce
 API version:  1.30 (minimum version 1.12)
 Go version:   go1.8.3
 Git commit:   02c1d87
 Built:        Fri Jun 23 21:21:56 2017
 OS/Arch:      linux/amd64
 Experimental: false

# docker pull takayoshi733.azurecr.io/nginx:latest
latest: Pulling from nginx
94ed0c431eb5: Pull complete 
9406c100a1c3: Pull complete 
aa74daafd50c: Pull complete 
Digest: sha256:788fa27763db6d69ad3444e8ba72f947df9e7e163bad7c1f5614f8fd27a311c3
Status: Downloaded newer image for takayoshi733.azurecr.io/nginx:latest

[sajayantony]

@tanaka-takayoshi Thanks for bringing this to our attention. We will make a note to call this out.
@SteveLas - Do we document what is the supported docker tooling version in VS and other areas. It think ACR should also use the same min version requirement.
/cc @yuwaMSFT2

[yuwaMSFT2]

I have been using some older version 1.11.2 and 1.12.1 on Ubuntu and they worked fine. The error means that for docker push it picked up the correctly cached user:pwd pair for the registry example.azurecr.io from the config.json file, but for docker pull it didn't find matching cache entry for the same registry. It is strange and it should not be specific to Acr. I don't have Fedora so not sure.

Are you sure you are using the exactly same registry (example.azurecr.io)? Can you pull/push from docker hub or other registry?

[tanaka-takayoshi]

@YuanMSFT I use exactly same registry URL for pushing and pulling. Also, I can push and pull another private docker repository. Only Azure Container Registry fails to pull.

[datamattsson]

I can confirm this issue with Red Hat OpenShift 3.5 on RHEL 7.4 which uses Docker 1.12.6.

[ankurkhemani]

@drajen @tanaka-takayoshi I am able to push/pull images to ACR, running Docker 1.12.6 on RHEL 7.4. Here's a screenshot ..

[datamattsson]

@tanaka-takayoshi just for my own sanity, is this from an Azure VM or from a machine not running in Azure?

[tanaka-takayoshi]

Thanks @drajen . I confirmed --signature-verification=false is required with Docker 1.12.6 on RHEL 7.3. I confirmed the RHEL 7.3 on Azure. It seemed Red Hat provided Docker issue.

[sajayantony]

Closing this for now and can open if we see this again.