Error running against ACI

[lonevvolf]

Running through the example/instructions here:
https://docs.docker.com/cloud/aci-integration/#run-docker-containers-on-aci

I always get the error message:
containerinstance.ContainerGroupsClient#CreateOrUpdate: Failure sending request: StatusCode=400 -- Original Error: Code="MoreImageRegistryCredentialsThanContainers" Message="More image registry credentials provided than containers in container group 'quirky-agnesi'."

when trying to run the container as in the example:
docker --context myacicontext run -p 80:80 nginx

Steps to reproduce the issue:

1. Follow the tutorial at: https://docs.docker.com/cloud/aci-integration/

Describe the results you received:
containerinstance.ContainerGroupsClient#CreateOrUpdate: Failure sending request: StatusCode=400 -- Original Error: Code="MoreImageRegistryCredentialsThanContainers" Message="More image registry credentials provided than containers in container group 'quirky-agnesi'."

Describe the results you expected:
Container should be created/started.

Additional information you deem important (e.g. issue happens only occasionally):

Output of docker version:

Client:
 Cloud integration: v1.0.24
 Version:           20.10.14
 API version:       1.41
 Go version:        go1.16.15
 Git commit:        a224086
 Built:             Thu Mar 24 01:53:11 2022
 OS/Arch:           windows/amd64
 Context:           myacicontext
 Experimental:      true

Server: Docker Desktop 4.8.1 (78998)
 Engine:
  Version:          20.10.14
  API version:      1.41 (minimum version 1.12)
  Go version:       go1.16.15
  Git commit:       87a90dc
  Built:            Thu Mar 24 01:46:14 2022
  OS/Arch:          linux/amd64
  Experimental:     false
 containerd:
  Version:          1.5.11
  GitCommit:        3df54a852345ae127d1fa3092b95168e4a88e2f8
 runc:
  Version:          1.0.3
  GitCommit:        v1.0.3-0-gf46b6ba
 docker-init:
  Version:          0.19.0
  GitCommit:        de40ad0

Output of docker info:

Client:
 Context:    default
 Debug Mode: false
 Plugins:
  buildx: Docker Buildx (Docker Inc., v0.8.2)
  compose: Docker Compose (Docker Inc., v2.5.0)
  sbom: View the packaged-based Software Bill Of Materials (SBOM) for an image (Anchore Inc., 0.6.0)
  scan: Docker Scan (Docker Inc., v0.17.0)

Server:
 Containers: 0
  Running: 0
  Paused: 0
  Stopped: 0
 Images: 2
 Server Version: 20.10.14
 Storage Driver: overlay2
  Backing Filesystem: extfs
  Supports d_type: true
  Native Overlay Diff: true
  userxattr: false
 Logging Driver: json-file
 Cgroup Driver: cgroupfs
 Cgroup Version: 1
 Plugins:
  Volume: local
  Network: bridge host ipvlan macvlan null overlay
  Log: awslogs fluentd gcplogs gelf journald json-file local logentries splunk syslog
 Swarm: inactive
 Runtimes: io.containerd.runc.v2 io.containerd.runtime.v1.linux runc
 Default Runtime: runc
 Init Binary: docker-init
 containerd version: 3df54a852345ae127d1fa3092b95168e4a88e2f8
 runc version: v1.0.3-0-gf46b6ba
 init version: de40ad0
 Security Options:
  seccomp
   Profile: default
 Kernel Version: 5.10.102.1-microsoft-standard-WSL2
 Operating System: Docker Desktop
 OSType: linux
 Architecture: x86_64
 CPUs: 12
 Total Memory: 31.16GiB
 Name: docker-desktop
 ID: SJWN:4LAT:NVQS:O4DU:VROV:RAZ4:YDOL:TK7U:QQ2Y:FQFL:LL3Z:DAQ5
 Docker Root Dir: /var/lib/docker
 Debug Mode: false
 HTTP Proxy: http.docker.internal:3128
 HTTPS Proxy: http.docker.internal:3128
 No Proxy: hubproxy.docker.internal
 Registry: https://index.docker.io/v1/
 Labels:
 Experimental: false
 Insecure Registries:
  hubproxy.docker.internal:5000
  127.0.0.0/8
 Live Restore Enabled: false

WARNING: No blkio throttle.read_bps_device support
WARNING: No blkio throttle.write_bps_device support
WARNING: No blkio throttle.read_iops_device support
WARNING: No blkio throttle.write_iops_device support

Additional environment details (AWS, VirtualBox, physical, etc.):

[rumpl]

Hi @lonevvolf, I transferred this issue to docker/compose-cli since that's where the cloud integration lives

[lonevvolf]

I've done a bit more experimentation on this and found:

1. The commands run fine on a fresh Docker Desktop installation without logging in to Docker Desktop
2. Once you log in to Docker Desktop and try the command again, you get the message:
   containerinstance.ContainerGroupsClient#CreateOrUpdate: Failure sending request: StatusCode=400 -- Original Error: Code="MoreImageRegistryCredentialsThanContainers" Message="More image registry credentials provided than containers in container group 'sweet-austin'."
3. If I now logout, either through command line or GUI and try to create the container, I get:
   containerinstance.ContainerGroupsClient#CreateOrUpdate: Failure sending request: StatusCode=400 -- Original Error: Code="InaccessibleImage" Message="The image 'nginx' in container group 'exciting-curran' is not accessible. Please check the image and registry credential."

As of yet, I am unable to get it working again.

[pemmenegger]

Same here! However, it is working in the default context, i.e.:

docker --context default run -p 80:80 nginx
OR
docker context use default then docker compose up

It is also working being in my context if I only use images hosted on azurecr.io

[lonevvolf]

Reproduced again with v4.8.2. Still can't deploy to ACI.

[lonevvolf]

So it appears that MS has decided that the Docker Hub repo is not in some default search hierarchy. The example page should be changed to specify the site where the image is hosted. ie.
docker --context myacicontext run -p 80:80 registry.hub.docker.com/library/nginx

Using this, the command succeeds.

[syedsuhaib]

Thank you @lonevvolf for sharing the outcome of your troubleshooting. From @pemmenegger's comment, it seems the docker aci integration defaults to azurecr.io as the container registry for lookup.

From documentation of Docker Azure Integration:

You can deploy private images to ACI that are hosted by any container registry. You need to log into the relevant registry using docker login before running docker run or docker compose up. The Docker CLI will fetch your registry login for the deployed images and send the credentials along with the image deployment information to ACI. In the case of the Azure Container Registry, the command line will try to automatically log you into ACR from your Azure login.

[lonevvolf]

@syedsuhaib Thank you for following up. Unfortunately, exactly the instructions you provided (docker lockin) produce the errors listed above. Only specifying the repo in the command line fixes the issue. Therefore, the example page referenced (https://docs.docker.com/cloud/aci-integration/#run-docker-containers-on-aci) should be updated or no one will be able to successfully execute the steps.

[syedsuhaib]

I have created a PR to update the documentation as suggested by you. Waiting for it to be reviewed before it can be merged into Docker Docs.

[samibrahmi]

@lonevvolf thank you for your comment. It saved my day cause I have the same problem. Docker must update their documentation (https://docs.docker.com/cloud/aci-integration/).

[josecelano]

So it appears that MS has decided that the Docker Hub repo is not in some default search hierarchy. The example page should be changed to specify the site where the image is hosted. ie. docker --context myacicontext run -p 80:80 registry.hub.docker.com/library/nginx

Using this, the command succeeds.

That worked for me, but now I'm getting a different error message:

containerinstance.ContainerGroupsClient#CreateOrUpdate: Failure sending request: StatusCode=400 -- Original Error: Code="InaccessibleImage" Message="The image 'registry.hub.docker.com/josecelano/torrust-tracker:v0.1.0' in container group 'stoic-lehmann' is not accessible. Please check the image and registry credential."

[josecelano]

registry.hub.docker.com

I've removed the context and created a new one, which now works.

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[Hardy74]

I run into the same issue, following the example https://docs.docker.com/cloud/aci-integration/. This comment solves it for me #2150 (comment)

[stale]

This issue has been automatically marked as not stale anymore due to the recent activity.

[ryan-adler]

@syedsuhaib It looks like your PR was not merged due to some technicality. Can you please check that?