Cannot pull image in WebApp from ACR with private endpoint enabled

Question

I have a azure webapp Container , and azure container registry

The app is up and can pull image from acr when no security enabled (private endpoint)

If i enable private endpoint in the web app , the web app cannot pull the image from ACR

this is the logs from Azure DevOps

2021-06-28T07:37:06.7931299Z Single-container Deployment to the webapp 'XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX' as only the image detail was specified.
2021-06-28T07:37:07.0710385Z Trying to update App Service Configuration settings. Data: {"appCommandLine":null,"linuxFxVersion":"DOCKER|XXXXXXXXXXXXXXX.azurecr.io/XXXXXXXXXXXXXX:976"}
2021-06-28T07:37:14.0740862Z Updated App Service Configuration settings.
2021-06-28T07:37:14.0742609Z Restarting App Service: XXXXXXXXXXXXXXXXXXX
2021-06-28T07:37:14.3232789Z App Service 'XXXXXXXXXXXXXXXXXXXX' restarted successfully.
2021-06-28T07:37:15.3657905Z ##[warning]Error: Failed to update deployment history. Error: Ip Forbidden (CODE: 403)
2021-06-28T07:37:15.7454935Z App Service Application URL: https://XXXXXXXXXXXXXXXXXXXXXXXXXXX
2021-06-28T07:37:15.7532798Z ##[section]Finishing: Azure Web App on Container Deploy: XXXXXXXXXXXXXXXXXXXXXXXXXXXX

In the log in Azure Portal, the web app looks consider the ACR registry as Docker hub:

2021-06-28T08:06:54.100Z INFO  - Pulling image from Docker hub: XXXXXXXXXXXXXXXXXXXXX
2021-06-28T08:06:54.201Z ERROR - DockerApiException: Docker API responded with status code=InternalServerError, response={"message":"Get https://XXXXXXXXXXXXXXXXXXXXXXXXXXX/v2/XXXXXXXXXXXXX/manifests/976: unauthorized: authentication required, visit https://aka.ms/acr/authorization for more information."}

2021-06-28T08:06:54.203Z ERROR - Image pull failed: Verify docker image configuration and credentials (if using private repository)
2021-06-28T08:06:54.205Z INFO  - Stopping site XXXXXXXXXXXXXXXXXXXXXX because it failed during startup.

this is my AzureDevops step :

Any idea to resolve that ?

Charles Xu Charles Xu · Accepted Answer · 2021-06-29T02:44:30

The problem is that you don't have permission to pull the image from ACR. ACR is a private registry, so you need to set the credential of ACR for the Web App. And Azure Web App for container uses the environment variables to set the credential for the private registry. Here are the variables for the ACR:

DOCKER_REGISTRY_SERVER_USERNAME - The username for the ACR server.
DOCKER_REGISTRY_SERVER_URL - The full URL to the ACR server. (For example, https://my-server.azurecr.io.)
DOCKER_REGISTRY_SERVER_PASSWORD - The password for the ACR server.

And in the DevOps, you set the variables like this:

Cannot pull image in WebApp from ACR with private endpoint enabled

1 Answers