Push Docker Image task to ACR fails in Azure DevOps Pipeline with “unauthorized: authentication required”

3
votes

Push and image to Azure Container Registry task in Azure DevOps pipeline fails. Previous tasks are executed fine ie. docker image is create and login to ACR is successful. However push-task fails with the following result:

unauthorized: authentication required
[error]unauthorized: authentication required
[error]/usr/bin/docker failed with return code: 1
[section]Finishing: Push Docker image

docker push to that given acr works fine from local command line.

# Docker image
# Build a Docker image to deploy, run, or push to a container registry.
# Add steps that use Docker Compose, tag images, push to a registry, run an image, and more:
# https://docs.microsoft.com/azure/devops/pipelines/languages/docker

trigger:
- master

pool:
  vmImage: 'Ubuntu-16.04'

variables:
  imageName: 'renamed:$(build.buildId)'
  azureSubscriptionEndpoint: Renamed
  azureContainerRegistry: renamed.azurecr.io
steps: 
- task: Docker@1
  displayName: Build docker image
  inputs:
    command: Build an image
    dockerFile: Dockerfile
    imageName: $(imageName)
    containerregistrytype: Azure Container Registry
    azureSubscriptionEndpoint: $(azureSubscriptionEndpoint)
    azureContainerRegistry: $(azureContainerRegistry)
- task: Docker@1
  displayName: Login to container registry
  inputs:
    command: login
    containerregistrytype: Azure Container Registry
    azureSubscriptionEndpoint: $(azureSubscriptionEndpoint)
    azureContainerRegistry: $(azureContainerRegistry)
    dockerFile: Dockerfile
    imageName: $(imageName)
- task: Docker@1
  displayName: Push Docker image
  inputs:
    command: Push an image
    containerregistrytype: Azure Container Registry
    azureSubscriptionEndpoint: $(azureSubscriptionEndpoint)
    azureContainerRegistry: $(azureContainerRegistry)
    imageName: $(imageName)
4
azure-devops

4 Answers

2
votes

remove the docker login step from your build, docker tasks handle auth for you using azure subscription endpoint (if it is properly configured), if not - give your service principal permissions to acrpush).

7
votes

I had the same issue when I used an Azure Container Registry Service Connection in Azure DevOps.

The work around was to not choose ‘Azure Container Registry’ when creating the Docker Registry Service Connection and to instead choose ‘Others’. Then in the Azure Portal enable admin user on your container registry and use the credentials from that to create the service connection.

0
votes

Go to Project Settings --> Service connection --> Edit --> revalidate the permission

should fix the problem

0
votes

In my case I am tagging my images with 433.

ex: <containerRegistryName>.azurecr.io:443/<imageName>

after removing the 433, and tried to push again, it succeeded!