Unable to authorize in Azure DevOps (Artifacts) when building a docker image

Question

I have Artifacts in Azure DevOps and trying to create a docker build.

Platform: Microsoft .NET Core 3.1
Docker (local): 19.03.12

Steps I did:

Created a PAT in Azure DevOps (with full permissions)
Generated a Dockerfile using Visual Studio 2019
Added it in Dockerfile:

ENV VSS_NUGET_EXTERNAL_FEED_ENDPOINTS
"{"endpointCredentials": [{"endpoint":"https://pkgs.dev.azure.com/MYCOMPANY/_packaging/MYPROJECT/nuget/v3/index.json", "username":"USER", "password":"GENERATED_PAT"}]}"

After COPY commands added:

RUN dotnet restore -s "https://https://pkgs.dev.azure.com/MYCOMPANY/_packaging/MYPROJECT/nuget/v3/index.json" "Project/ProjectName.csproj"

But I receive an "unauthorized" error when I run: docker build . -t mydockerfile:v1

/usr/share/dotnet/sdk/3.1.401/NuGet.targets(128,5): error : Unable to load the service index for source https://pkgs.dev.azure.com/MYCOMPANY/_packaging/MYPROJECT/nuget/v3/index.json. [/src/Project/ProjectName.csproj] /usr/share/dotnet/sdk/3.1.401/NuGet.targets(128,5): error : Response status code does not indicate success: 401 (Unauthorized). [/src/Project/ProjectName.csproj] The command '/bin/sh -c dotnet restore -s "https://pkgs.dev.azure.com/MYCOMPANY/_packaging/MYPROJECT/nuget/v3/index.json" "Project/ProjectName.csproj"' returned a non-zero code: 1

Dockerfile

FROM mcr.microsoft.com/dotnet/core/aspnet:3.1-buster-slim AS base
WORKDIR /app
EXPOSE 80

ENV NUGET_CREDENTIALPROVIDER_SESSIONTOKENCACHE_ENABLED true
ENV VSS_NUGET_EXTERNAL_FEED_ENDPOINTS \
"{"endpointCredentials": [{"endpoint":"https://pkgs.dev.azure.com/MYCOMPANY/_packaging/MYPROJECT/nuget/v3/index.json", "username":"USER", "password":"GENERATED_PAT"}]}"


FROM mcr.microsoft.com/dotnet/core/sdk:3.1-buster AS build
WORKDIR /src

COPY ["MyAPP.Api/MyAPP.Api.csproj", "MyAPP.Api/"]
COPY ["MyAPP.DI/MyAPP.DI.csproj", "MyAPP.DI/"]
COPY ["MyAPP.Application/MyAPP.Application.csproj", "MyAPP.Application/"]
COPY ["MyAPP.Domain/MyAPP.Domain.csproj", "MyAPP.Domain/"]
COPY ["MyAPP.Infrastructure/MyAPP.Infrastructure.csproj", "MyAPP.Infrastructure/"]

RUN dotnet restore -s "https://pkgs.dev.azure.com/MYCOMPANY/_packaging/MYPROJECT/nuget/v3/index.json" "MyAPP.Domain/MyAPP.Domain.csproj"

COPY . .
WORKDIR "/MyAPP.Api"
RUN dotnet build "MyAPP.Api.csproj" -c Release -o /app/build

FROM build AS publish
RUN dotnet publish "MyAPP.Api.csproj" -c Release -o /app/publish

FROM base AS final
WORKDIR /app
COPY --from=publish /app/publish .
ENTRYPOINT ["dotnet", "MyAPP.Api.dll"]

Any update for this issue? The endpointCredentials way won't work if you doesn't have Azure Artifacts Credential Provider installed. Maybe you can use nuget.config way for your authentication, check my another ticker here. Also this similar one. — LoLance
Hi, is there any update for this issue? Please check if my answer below resolves your issue and feel free to let me know if you're blocked. In addition, here's one blog which can help for you, it contains one dockerfile with steps to set the ENV and install the Artifact Credential provider. — LoLance

LoLance LoLance · Accepted Answer · 2020-09-02T09:22:12

Main cause of the issue:

The dotnet restore command can't actually access the credentials you set via ENV.

You can add RUN printenv to print the ENV variables.

FROM mcr.microsoft.com/dotnet/core/aspnet:3.1-buster-slim AS base
WORKDIR /app
EXPOSE 80

ENV NUGET_CREDENTIALPROVIDER_SESSIONTOKENCACHE_ENABLED true
ENV VSS_NUGET_EXTERNAL_FEED_ENDPOINTS \
"{"endpointCredentials": [{"endpoint":"https://pkgs.dev.azure.com/MYCOMPANY/_packaging/MYPROJECT/nuget/v3/index.json", "username":"USER", "password":"GENERATED_PAT"}]}"
RUN printenv

FROM mcr.microsoft.com/dotnet/core/sdk:3.1-buster AS build
WORKDIR /src
RUN printenv

Check the log of first printenv and second printenv command and you can find the environment you run the dotnet restore can't access the credentials.

Solution:

You can move/copy the define ENV step just before the RUN dotnet restore step.

FROM mcr.microsoft.com/dotnet/core/sdk:3.1-buster AS build
WORKDIR /src

...

ENV NUGET_CREDENTIALPROVIDER_SESSIONTOKENCACHE_ENABLED true
ENV VSS_NUGET_EXTERNAL_FEED_ENDPOINTS \
"{"endpointCredentials": [{"endpoint":"https://pkgs.dev.azure.com/MYCOMPANY/_packaging/MYPROJECT/nuget/v3/index.json", "username":"USER", "password":"GENERATED_PAT"}]}"

RUN dotnet restore -s "https://pkgs.dev.azure.com/MYCOMPANY/_packaging/MYPROJECT/nuget/v3/index.json" "MyAPP.Domain/MyAPP.Domain.csproj"

Unable to authorize in Azure DevOps (Artifacts) when building a docker image

1 Answers