Permission denied on docker pull from Google Cloud Compute

lorey 0
Viewed 41

So I set up a minimal Google Cloud Compute instance with terraform and want to use a docker image on it. The desired image is pushed to an artifact repository in the same project.

Error

The issue is that whatever I do, when trying to pull with the pull command specified in the artifact repo, I get:

sudo docker pull europe-west3-docker.pkg.dev/[project]/[repo]/[image]:latest
Error response from daemon: 
Head "https://europe-west3-docker.pkg.dev/v2/[project]/[repo]/api/manifests/latest": denied: 
Permission "artifactregistry.repositories.downloadArtifacts" denied on resource "projects/[project]/locations/europe-west3/repositories/[repo]" (or it may not exist)

Debugging attempts

What I've tried:

  • The default service account should have access without any additional setup. To debug and make sure nothing goes wrong, I tried creating a service account with the necessary role myself.
  • Tried to debug access with the policy troubleshooting tool, access should be possible
  • Made sure to enable docker auth with gcloud auth configure-docker europe-west3-docker.pkg.dev and debugged the used account with gcloud auth list.
  • Tried the pull command on my local machine, works flawlessly
  • Tried to access the repo via gcloud artifacts docker images list [repo], works fine as well
  • Tried to run gcloud init
  • Tried pulling images from the official docker repo, also works flawlessly

Terraform code for reference

#
# INSTANCE
#
resource "google_compute_instance" "mono" {
  name = "mono"
  machine_type = "n1-standard-1"
  allow_stopping_for_update = true  # allows hard updating

  service_account {
    scopes = ["cloud-platform"]
  }

  boot_disk {
    initialize_params {
      image = "debian-cloud/debian-11"
    }
  }

  network_interface {
    network = "default"
    access_config {

    }
  }
}


#
# REPO
#
resource "google_artifact_registry_repository" "repo" {
  location      = var.location
  repository_id = var.project_name
  format        = "DOCKER"
}
terraform-provider-gcp terraform google-cloud-platform docker
1 Answers

Solution

After wasting too many hours on this, I found that after adding my user to the docker group and thus running docker without sudo, it suddenly works.

So as laid out here: https://docs.docker.com/engine/install/linux-postinstall/

sudo groupadd docker
sudo usermod -aG docker $USER
# exit and login again via ssh

Explanation

As per the docs:

Note: If you normally run Docker commands on Linux with sudo, Docker looks for Artifact Registry credentials in /root/.docker/config.json instead of $HOME/.docker/config.json. If you want to use sudo with docker commands instead of using the Docker security group, configure credentials with sudo gcloud auth configure-docker instead.

So if you use docker with sudo, you also need to run

sudo gcloud auth configure-docker

I thought I had tried this, but it is what it is...

lorey0
Related