Facing issue in configuring AWS ECR as a registry using credential helper for Nebula worker. about worker HOT 7 CLOSED

Issue-Label Bot is automatically applying the label question to this issue, with a confidence of 0.61. Please mark this comment with 👍 or 👎 to give our bot feedback!

Links: app homepage, dashboard and code for this bot.

from worker.

The reason your seeing issues is likely because that while you configured ~/.docker/config.json you did so on the host, not on the worker container - you'll need to mount the ~/.docker/config.json onto the same path inside the worker container for it to be able to see your configured config.json (read only will likely be enough but not 100% sure about it).

There's a bit more info about it on https://nebula.readthedocs.io/en/latest/config/worker/ on the registry_auth_user & registry_auth_password description fields.

from worker.

Hello @naorlivne

Thanks for the response. I mounted ~/.docker/config.json onto the same path inside the worker container. But I am getting this error =>

worker    | reading config variables
worker    | /usr/local/lib/python3.7/site-packages/parse_it/file/file_reader.py:55: UserWarning: config_folder_location does not exist, only envvars & cli args will be used
worker    |   warnings.warn("config_folder_location does not exist, only envvars & cli args will be used")
worker    | reading config variables
worker    | no registry user pass combo defined, skipping registry login
worker    | checking nebula manager connection
worker    | nebula manager connection ok
worker    | stopping all preexisting nebula managed app containers in order to ensure a clean slate on boot
worker    | initial start of <my-image> app
worker    | pulling image <my_registry_url>/<my-image>:latest
worker    | <my_registry_url>/<my-image>
worker    | problem pulling image <my_registry_url>/<my-image>:latest
worker    | docker-credential-ecr-login not installed or not available in PATH

This is my docker-compose.yml =>

version: '3'
services:
  worker:
    container_name: worker
    build:
      context: .
      dockerfile: Dockerfile
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - /root/.docker/config.json:/root/.docker/config.json
    restart: unless-stopped
    hostname: worker
    environment:
      REGISTRY_HOST: < my_regisrty_url >
      MAX_RESTART_WAIT_IN_SECONDS: 0
      NEBULA_MANAGER_AUTH_USER: nebula
      NEBULA_MANAGER_AUTH_PASSWORD: nebula
      NEBULA_MANAGER_HOST: < my_manager_url >
      NEBULA_MANAGER_PORT: 80
      NEBULA_MANAGER_PROTOCOL: http
      NEBULA_MANAGER_CHECK_IN_TIME: 30
      DEVICE_GROUP: test
      KAFKA_BOOTSTRAP_SERVERS: < my_manager_url >:9092
      KAFKA_TOPIC: nebula-reports

what am I doing wrong here?

from worker.

worker | docker-credential-ecr-login not installed or not available in PATH seems like the important line to me, I admit to not being a big fan of ECR exectly due to headaches like this so I may be wrong but it seems like it requires access to the ECR codebase rather then just the config.json (which is not part of the container but rather the host again) making this related to awslabs/amazon-ecr-credential-helper#56

Seems like you'll have to install the Amazon ECR Docker Credential Helper & configure it (including the AWS access keys) inside the worker container to get it to work.

Possibly helpful link - https://serverfault.com/questions/897636/how-to-add-amazon-ecr-credential-helper-to-path

from worker.

Hello, @naorlivne Thanks for the response. Is there a better alternative for ECR that I can integrate with the Nebula worker.

Note: I have already tried docker registry open source. But I am looking for a solution which has a GUI which makes easy in the management of the releases (i.e. Images ). As ECR was suitable for that use case so I went with the ECR.

from worker.

Personally I use docker hub as it's managed by Docker Inc but any registry that supports the standard docker login process will work

from worker.

Thanks, I'll check it.

from worker.