ElasticBeanstalk - cannot pull docker image from private Docker Hub repo

Question

I'm deploying a docker image to ElasticBeanstalk (using a CodePipeline). My Dockerrun.aws.json looks like this:

{
  "AWSEBDockerrunVersion": "1",
  "Authentication": {
    "Bucket": "mybucket",
    "Key": "docker_hub_auth.json"
  },
  "Image": {
    "Name": "repo/image:tag",
    "Update": "true"
  },
  "Ports": [
    {
      "ContainerPort": "8080"
    }
  ]
}

And I'm getting error from ElasticBeanstalk instance: Failed to pull Docker image repo/image:tag: Error response from daemon: pull access denied for repo/image, repository does not exist or may require 'docker login': denied: requested access to the resource is denied. Check snapshot logs for details. (Executor::NonZeroExitStatus)

When I ssh to the instance, I can check that the auth file docker_hub_auth.json is being successfully downloaded. What surprises me is, that the file is downloaded to /root/.dockercfg (from 03build.sh via download_auth.py). Then docker pull is invoked. But I assume the docker expects the auth in /root/.docker/config.json!

When I manually do docker login on the instance, it adds the Docker Hub auth to the /root/.docker/config.json and deploy starts working. But obviously I need to make it work without the manual docker login in case my instance is replaced or a new instance started.

It seems like a bug to me. What can I do? Automated scripts download auth to /root/.dockercfg but the docker (Docker version 19.03.6-ce, build 369ce74) needs it in /root/.docker/config.json. Any advice how to overcome it?

UPDATE, SOLVED

A have moved to Amazon Linux 2 and now it works.

user_248823 · Answer

You could use ebextensions to run bash commands to move the file into required place.

Depending when the files are downloaded, you can either use Commands or Container commands to do that. Alternatively, there are platform hooks which you can also use.

user_5712821 · Answer

I experimented a very similar issue. Some months ago I had configured an Elastic Beanstalk environment running Docker and pulling an image from a private Docker Hub repository, and this was as well implemented as a Bitbucket Pipeline. Today I attempted to do the same exact process again for a different project and I was unable to get it running, receiving this very same error: Failed to pull Docker image repo/image:tag: Error response from daemon: pull access denied for repo/image, repository does not exist or may require 'docker login': denied: requested access to the resource is denied.

For my case, the solution was to terminate my environment and create a new one using the latest Docker running on 64bit Amazon Linux version; in my case 2.15.4.

This auth error for docker private repos seems to be happening for Docker running on 64bit Amazon Linux 2, probably there's some additional configuration that needs to be set using ebextensions or something. Since the current version for this platform branch is 3.1.2

However, I hope someone can also get their problem resolved by making sure to use this Docker-Linux version for your Elastic Beanstalk environment

ElasticBeanstalk - cannot pull docker image from private Docker Hub repo

2 Answers