42

I have an image on Amazon's Elastic Container Registry (ECR) that I want to deploy as a Docker service in my Docker single-node swarm. Currently the service is running an older version of the image's latest tag, but I've since uploaded a newer version of the latest tag to ECR.

Running docker service update --force my_service on my swarm node, which uses image XXXXXXXXXXXX.dkr.ecr.us-east-1.amazonaws.com/my_service:latest, results in:

image XXXXXXXXXXXX.dkr.ecr.us-east-1.amazonaws.com/my_service:latest could not be accessed on a registry to record its digest. Each node will access XXXXXXXXXXXX.dkr.ecr.us-east-1.amazonaws.com/my_service:latest independently, possibly leading to different nodes running different versions of the image.

This appears to prevent the node from pulling a new copy of the latest tag from the registry, and the service from properly updating.

I'm properly logged in with docker login to ECR, and running docker pull XXXXXXXXXXXX.dkr.ecr.us-east-1.amazonaws.com/my_service:latest works fine (and returns a digest).

Why is docker service update unable to read the digest from the ECR registry despite the image being available?

Sebastian Brosch
  • 42,106
  • 15
  • 72
  • 87
David Elner
  • 5,091
  • 6
  • 33
  • 49
  • I seem to be getting the same error when running: "docker service update --with-registry-auth --image example.com/group/myimage:X.Y.Z mystack_myservice". I run docker 17.05. I've logged into the gitlab container registry before running the command as well (on the manager node) so it should not have any problem accessing the registry. The error: "Error: image example.com/group/myimage:X.Y.Z could not be accessed on a registry to record its digest." – Snorre Jun 01 '17 at 13:54
  • My problem turned out to be that I was using the wrong image tag (the version part). As long as I'm logged in and use the --with-registry-auth argument it works. – Snorre Jun 02 '17 at 09:11

1 Answers1

66

I had the same problem, but I solved it by using --with-registry-auth. After you logged in with docker login, can you confirm the same update command with --with-registry-auth?

https://github.com/moby/moby/issues/34153#issuecomment-316047924

kev
  • 8,928
  • 14
  • 61
  • 103
Akira Fukushima
  • 996
  • 7
  • 5