Search code examples
dockergcloudgoogle-container-registry

Unable to access private container registry from gcloud compute VM

I'm trying to pull a container from a private gcloud registry from a gcloud VM using service account for authentication. The VM and registry are in the same project. No matter what I do I always get Error response from daemon: unauthorized.

XXX@sandbox:~$ gcloud auth configure-docker gcr.io
WARNING: Your config file at [/home/XXX/.docker/config.json] contains these credential helper entries:

{
  "credHelpers": {
    "gcr.io": "gcloud"
  }
}
Adding credentials for: gcr.io
gcloud credential helpers already registered correctly.

XXX@sandbox:~$ sudo docker pull gcr.io/MY-PROJECT-ID/MY-IMAGE:latest
Error response from daemon: unauthorized: You don't have the needed permissions to perform 
this operation, and you may have invalid credentials. To authenticate your request, follow 
the steps in: https://cloud.google.com/container-registry/docs/advanced-authentication

The service account has Storage Admin role for the gcr.io storage bucket:

enter image description here

The VM has storage access enabled as Read-Write:

enter image description here

The VM was stopped, restarted multiple times. Docker is up to date:

XXX@sandbox:~$ which docker
/usr/bin/docker
XXX@sandbox:~$ sudo docker version
Client: Docker Engine - Community
 Version:           19.03.8
 API version:       1.40
 Go version:        go1.12.17
 Git commit:        afacb8b7f0
 Built:             Wed Mar 11 01:26:02 2020
 OS/Arch:           linux/amd64
 Experimental:      false

Server: Docker Engine - Community
 Engine:
  Version:          19.03.8
  API version:      1.40 (minimum version 1.12)
  Go version:       go1.12.17
  Git commit:       afacb8b7f0
  Built:            Wed Mar 11 01:24:36 2020
  OS/Arch:          linux/amd64
  Experimental:     false
 containerd:
  Version:          1.2.13
  GitCommit:        7ad184331fa3e55e52b890ea95e65ba581ae3429
 runc:
  Version:          1.0.0-rc10
  GitCommit:        dc9208a3303feef5b3839f4323d9beb36df0a9dd
 docker-init:
  Version:          0.18.0
  GitCommit:        fec3683

I can get it to work using JSON keyfile but not with the recommended gcloud auth configure-docker. I guess there is some yet another undocumented switch or permission that I need to flip but I just can't see.

Solution

  • You can pass the account or the impersonate-service-account to the command:

       gcloud auth configure-docker --account
   gcloud auth configure-docker ----impersonate-service-account

    When you run with sudo you change the environment and it will not authenticate to the gcr.io, thus the unauthorized.