Hi Team, Continuing the discussion from NotSpecified: You will need docker installed and running to pull docker images:
I am facing the same issue when pulling the image from AWS ECR Registry, fails on acquiring the package on octopus deploy. Error screenshot attached.
As suggested, have tried including windows binaries, as installed docker EE on 2019 windows octopus server and the restart of server didn’t help to resolve the issue. Any help is highly appreciated.
Hi @parnithakaleru,
Thanks for reaching out to Octopus Deploy support!
This error (as you’ve pointed out through this previous post) usually indicates that the path doesn’t include the Docker binaries in order to find it. If you’ve confirmed they exist and have performed a Windows restart (to force a refresh), I’d like to continue troubleshooting this by obtaining the Raw Task Logs from this task. This should give me a clearer idea on how you’ve configured your step.
I’ve also created a secure upload link for you to send through the logs.
I look forward to hearing back and helping you get to the bottom of this.
Kind regards,
Lauren
Thanks Lauren for getting back to me. To provide more info and steps I followed, when researched for docker EE binaries, found this link Index of win/static/stable/x86_64/ and downloaded docker-20.10.9.zip. Secondly provided the downloaded path into environmental variables PATH. Then, restarted the server.
The docker EE installed on the server is also of 20.10.9 version. Have sent through the RAW task log as requested.
This is the first time setting up like this on octopus, where the external feed is pulling image from AWS ECR Registry. This image is pushed via docker from Amazon Linux instance to AWS ECR.
Regards,
Parnitha
Good afternoon @parnithakaleru,
Just jumping in for Lauren who is currently off shift as part of our Australian based team. I took a look at your logs and this forum post and this does seem like something is missing form your docker install here.
Can I just confirm the previous ticket you linked is the same discussion, so all of the information in that forum post is from your instance? My answers below are on the assumption that ticket is talking about your instance that is all.
You mentioned setting the environment variables on the PATH, I am wondering if you would not mind checking those for me and just making sure they are set for the system and not your user account. The Octopus service will be running under a different account so making sure those variables are set under the system account not a local user account would be the first thing to check.
Did you install Docker EE using this guide:
https://docs.mirantis.com/mcr/20.10/install/mcr-windows.html
From the previous post it looks like you installed docker using Mirantis Container Runtime.
I can see you ran the docker version command in powershell and its printed out the correct information. What happens if you run that command in Octopus via a ‘Run a Script’ step or using the Octopus Script console (Octopus UI > Tasks > Script Console)? Does it print out the same information or does it error out?
Are you able to run step 4 from the ‘Install MCR’ documentation I linked so you are pulling an image? Does it pull successfully outside of Octopus using powershell?
I look forward to hearing from you,
Kind Regards,
Clare
Hi Clare,
Thank you for picking this up.
The previous ticket is not from my instance, when I encountered issues and thought of raising it with your support team, found a similar issue but for Azure, hence tagged it.
Steps I have followed:
I have installed Docker EE from Install Docker Enterprise Edition for Windows Server | Docker Documentation
Included docker binaries from Index of win/static/stable/x86_64/ and downloaded docker-20.10.9.zip
Environment PATH set as below, set to local user as you have pointed - Will change to the server account
Powershell commands from Docker installation are as below.
Hey @parnithakaleru,
Thank you for the clarification on the other ticket and for going through how you set this up. I can see it does look like your docker pull has worked locally. Was that docker pull done from the account associated with your Octopus Service or your account?
If you can change the environment paths to the Octopus Service account, run the powershell console as that Octopus service account and run those commands and see what output you get. If it allows you to pull the Hello-World image are you able to try pulling the image in the deployment? So try performing the docker pull to your AWS target:
https://xxxxxx.xxxxxx.amazonaws.com
Let me know how those tests go, hopefully we can pinpoint the issue.
Kind Regards,
Clare
Hi Clare,
The environment paths have been changed to the octopus service account. From the below screenshot admin user docker pulls works fine but octopus service user throws error.
After little research checked the services.msc if docker engine is running, and yes it is running. For the error that showing if it was Docker Desktop, running this command (& ‘C:\Program Files\Docker\Docker\DockerCli.exe’ -SwitchDaemon) would resolve the issue. But my installation is Docker EE. Any advice at this point?
Regards,
Pari
Hey @parnithakaleru,
I am really sorry this is still giving you issues, at least we are getting somewhere, unfortunately this does prove this is environmental now and not an Octopus Issue however, we don’t like to leave users in the lurch. I did a bit of googling myself as I am not a docker expert, especially docker EE which I admit I have never used.
But I did find this which may be of use to you, it seems like the issue here is to run docker commands the account as to be an admin on the machine you are running it on.
This article explains it a bit better:
So, you have a few options, the easiest one, although this does depend on how your network administrators and GPOs for security works, also your security policy on your network. But you could add the Octopus Service account as a member of the local administrators group on your Octopus server. If you do this as a test and try running the same PowerShell commands you should be able to see if that is what the issue is here.
The second (and better option) is to follow that article on allowing access to docker for non-admins and see if that allows that account to run docker.
There is a less detailed explanation of setting up the user rights for docker here.
Let me know what you think, I hope that will be helpful.
Kind Regards,
Clare
Hi Clare,
I am in a place where I can login to docker and also pull the ECR images from local(Amazon linux instance). However, the same pull from octopus script console throws no basic auth error
I tried installing the docker helper credentials(windows), but issue still exists. Any help is much appreciated.
Regards,
Pari
Hey @parnithakaleru,
Good news you managed to get a bit further along with the docker install.
I did a bit of googling around that issue and although I could not find a specific one about access denied I did find a few similar errors about writing to that config.json file.
The first thing to check would be the permissions on the folder for the config file (not sure where that would live I am afriad). Once you find it make sure your Octopus Service account has permissions to write to that file / folder.
The next thing to look at would be to copy that config file and store it somewhere else (for backup purposes). Then delete it out of that folder.
I found multiple articles referencing the no basic auth credentials and permission issues and all state if you delete that file it will work:
https://jhooq.com/aws-ecr-docker-login-error-credential/
Seems like when you do the intial login for docker with ECR it creates that config file. I wonder if you made Octopus create it when you run that step inside Octopus that would re-create the file with the right permissions and config settings?
Give it a go, if that does not work you can put the backup config file back so you have not lost any functionality from the CLI side.
Let me know how you get on,
Kind Regards,
Clare
Hi Clare,
Just wanted to update you and the forum that changing ntfs permissions resolved login issue.
Much appreciated!
Regards,
Pari
Hey @parnithakaleru,
Oh that’s fantastic news adding the Octopus service account to the NTFS permissions on the docker folder allows you to deploy now.
Are you all set, does that deployment now work?
We got there in the end, thank you for your patience whilst we worked through this with you,
Kind Regards,
Clare
This topic was automatically closed 31 days after the last reply. New replies are no longer allowed.
