使用 Az CLI 创建新的 Azure 容器实例时，无法从私有 Azure 容器注册表中提取映像

Question

I've created a service principal with push and pull access to/from my private Azure Container Registry. Pushing to ACR works perfectly fine with the following command:

az login --service-principal -u "someSpID" -p "someSpSecret"  --tenant "someTenantID"
az acr login --name "someRegistry"
docker push "someRegistry.azurecr.io/my-image:0.0.1"

And I am also able to pull the image directly with the following command:

docker pull "someRegistry.azurecr.io/my-image:0.0.1"

I want to deploy a container instance into a private subnet and I've configured the network security to allow access for my said subnet.

However, when I attempt to deploy a container instance with the following command into my private subnet, where I specified the same service principal which I had previously logged in with, I get an error response.

az container create \
  --name myContainerGroup \
  --resource-group myResourceGroup \
  --image "someRegistry.azurecr.io/my-image:0.0.1" \
  --os-type Linux \
  --protocol TCP \
  --registry-login-server someRegistry.azurecr.io \
  --registry-password someSpSecret \
  --registry-username someSpID \
  --vnet someVNET \
  --subnet someSubnet \
  --location someLocation \
  --ip-address Private

Error:

urllib3.connectionpool : Starting new HTTPS connection (1): management.azure.com:443
urllib3.connectionpool : https://management.azure.com:443 "PUT /subscriptions/mySubscription/resourceGroups/myResourceGroup/providers/Microsoft.ContainerInstance/containerGroups/myContainerGroup?api-version=2018-10-01 HTTP/1.1" 400
msrest.http_logger : Response status: 400

The image 'someRegistry.azurecr.io/my-image:0.0.1' in container group 'myContainerGroup' is not accessible. Please check the image and registry credential.

The same error ensues when I try and deploy the container instance through Azure Portal.

When I tried deploying a public image into the same subnet, it succeeds fine so it isn't a deployment permission issue, neither does it seem to be wrong service principal credentials as the docker pull "someRegistry.azurecr.io/my-image:0.0.1" works just fine. I can't quite wrap my head around this inconsistent behavior. Ideas anyone?

Answer 1

For your issue, here is a possible reason to explain the error you got. Let's look at the limitation describe here :

Only an Azure Kubernetes Service cluster or Azure virtual machine can be used as a host to access a container registry in a virtual network. Other Azure services including Azure Container Instances aren't currently supported.

This limitation shows the firewall of the Azure Container Registry does not support the Azure Container Instance currently. It only supports that pull/push the image in the Azure VM or AKS cluster.

So the solution for you is that change the rules to allow all network and then try again. Or use the AKS cluster, but it will also cost more.