If the docker file contains a base image from a private acr, then the az acr build will failed with authentication issue.

[JohnTangZX]

Describe the bug
I have a base image that is in one ACR, now I want to build another image using the base image and push it to another ACR using az acr build. It failed with authentication issue.

To Reproduce
Steps to reproduce the behavior:

1. Push the hello-world image to the ACR "srcacr".
2. Create a docker file with "FROM srcacr.azurecr.cn/sample/hello-world:v1"
3. Run the az acr build command below.

az acr build --image sample/hello-world:v2 --registry dstacr --file Dockerfile2 .

4. It will report the below error:

Packing source code into tar to upload...
Uploading archived source code from '/tmp/build_archive_8f5e281042644ed28cc90939d6a6a1b5.tar.gz'...
Sending context (501.000 Bytes) to registry: dstacr...
Queued a build with ID: fd7
Waiting for an agent...
2024/08/15 08:37:27 Downloading source code...
2024/08/15 08:37:28 Finished downloading source code
2024/08/15 08:37:28 Using acb_vol_9ad152d3-dfb8-42d1-ab57-7a7e0debc19d as the home volume
2024/08/15 08:37:28 Setting up Docker configuration...
2024/08/15 08:37:29 Successfully set up Docker configuration
2024/08/15 08:37:29 Logging in to registry: dstacr.azurecr.cn
2024/08/15 08:37:29 Successfully logged into dstacr.azurecr.cn
2024/08/15 08:37:29 Executing step ID: build. Timeout(sec): 28800, Working directory: '', Network: ''
2024/08/15 08:37:29 Scanning for dependencies...
2024/08/15 08:37:30 Successfully scanned dependencies
2024/08/15 08:37:30 Launching container with name: build
Sending build context to Docker daemon 7.168kB
Step 1/1 : FROM srcacr.azurecr.cn/sample/hello-world:v1
Head "https://srcacr.azurecr.cn/v2/sample/hello-world/manifests/v1": unauthorized: authentication required, visit https://aka.ms/acr/authorization for more information.
2024/08/15 08:37:30 Container failed during run: build. No retries remaining.
failed to run step ID: build: exit status 1

Run ID: fd7 failed after 3s. Error: failed during run, err: exit status 1
Run failed

Expected behavior
It should success.

Screenshots
If applicable, add screenshots to help explain your problem.

Any relevant environment information

• OS: Centos
• Azure CLI/PowerShell/SDK version: 2.38.1
• Docker version
• Datetime (UTC) when the issue occurred
• Registry and image names

Additional context
Add any other context about the problem here.

If any information is a concern to post here, you can create a support ticket or send an email to acrsup@microsoft.com.

[joshbaunach]

Hi @JohnTangZX - this behavior is by design. By default, az acr build in dstacr should not be able to pull from srcacr.

If you would like to build an image in dstacr using a local dockerfile that uses an image from srcacr as a base image, you can create a task with a managed identity that has permission to pull from srcacr. Details are described here: https://learn.microsoft.com/en-us/azure/container-registry/container-registry-tasks-authentication-managed-identity

Here are steps on how to create a task that can pull from srcacr in this specific scenario:

1. Create the file task.yml in the same directory as your dockerfile and paste this in there:

version: v1.1.0
steps:
  - build: -t $Registry/sample/hello-world:$ID -f Dockerfile2 .
  - push: ["$Registry/sample/hello-world:$ID"]

2. Create a task in dstacr with a system-assigned managed identity:

az acr task create \
--registry dstacr \
--name hello-world-task \
--commit-trigger-enabled false \
--assign-identity \
--context "/dev/null" \
--file task.yml

3. Grant your task's managed identity AcrPull permissions for srcacr

az role assignment create \
--assignee $(az acr task show -r dstacr -n hello-world-task --query "identity.principalId" -o tsv) \
--scope $(az acr show -n srcacr --query "id" -o tsv) \
--role acrpull

4. Add credentials for the system-assigned managed identity to your task:

az acr task credential add \
--name hello-world-task \
--registry dstacr \
--login-server srcacr.azurecr.cn \
--use-identity [system]

Those four steps will create a task that can pull from srcacr, and those commands only need to be run once. When you want to run the task using a local dockerfile, you can run this command:

az acr task run \
--name hello-world-task \
--registry dstacr \
--context .

[JohnTangZX]

Thank you for your help! You may close this one.