GCP VM Access to Artifact Registry

[luis-amarquez]

Hi, when I spin up the proxy in a gcp compute instance with a given service account, I can then allow that service account to pull from artifact registry. Then I setup docker by entering gcloud auth configure-docker us-central1-docker.pkg.dev. When I try to pull the image without docker proxy, everything works as it should and I am able to. However, when I try to use docker proxy, I am getting 403 errors.

[josep-tecnativa]

Could you share how you’re running the docker-socket-proxy container? For example, the docker run … command or the relevant part of your docker-compose.yml. That will help analyze the issue.

[luis-amarquez]

  docker-proxy:
    image: 'tecnativa/docker-socket-proxy:latest'
    restart: unless-stopped
    volumes:
      - '/var/run/docker.sock:/var/run/docker.sock:ro'
    networks:
      - docker-proxy
    environment:
      - LOG_LEVEL=info
      - POST=1
      - CONTAINERS=1
      - IMAGES=1
      - INFO=1
      - NETWORKS=1
    healthcheck:
      test:
        - CMD
        - nc
        - '-z'
        - 127.0.0.1
        - '2375'
      interval: 30s
      timeout: 5s
      retries: 5
      start_period: 5s```

[luis-amarquez]

Here is what is in my config

# ~/.docker/config.json
{
  "credHelpers": {
    "us-central1-docker.pkg.dev": "gcloud"
  }
}

and this is my response from docker proxy when I run the following command

$ curl -v -X POST http://localhost:2375/v1.41/images/create?fromImage=us-central1-docker.pkg.dev%2F<project id>%2F<namespace>%2F<repository>%3<tag>

{"message":"Head \"https://us-central1-docker.pkg.dev/v2/<namespace>/<repository>/manifests/<tag>\": denied: Unauthenticated request. Unauthenticated requests do not have permission \"artifactregistry.repositories.downloadArtifacts\" on resource \"projects/<project id>/locations/us-central1/repositories/<repository>\" (or it may not exist)"}

but again, doing docker pull ... works without issue when not using the docker socket proxy

[josep-tecnativa]

I think that the curl test is failing because POST /images/create requires an X-Registry-Auth header, which docker pull automatically adds using your gcloud credHelper. The proxy should already allow this endpoint with your current IMAGES=1 and POST=1 settings(I don't really know already why it fails). Maybe you could also enable AUTH=1 just in case.