Unable to authorize in Azure DevOps (Artifacts) when building a docker image

Question

I have Artifacts in Azure DevOps and trying to create a docker build.

• Platform: Microsoft .NET Core 3.1
• Docker (local): 19.03.12

Steps I did:

1. Created a PAT in Azure DevOps (with full permissions)
2. Generated a Dockerfile using Visual Studio 2019
3. Added it in Dockerfile:

ENV VSS_NUGET_EXTERNAL_FEED_ENDPOINTS
"{"endpointCredentials": [{"endpoint":"https://pkgs.dev.azure.com/MYCOMPANY/_packaging/MYPROJECT/nuget/v3/index.json", "username":"USER", "password":"GENERATED_PAT"}]}"

4. After COPY commands added:

RUN dotnet restore -s "https://https://pkgs.dev.azure.com/MYCOMPANY/_packaging/MYPROJECT/nuget/v3/index.json" "Project/ProjectName.csproj"

But I receive an "unauthorized" error when I run: docker build . -t mydockerfile:v1

/usr/share/dotnet/sdk/3.1.401/NuGet.targets(128,5): error : Unable to load the service index for source https://pkgs.dev.azure.com/MYCOMPANY/_packaging/MYPROJECT/nuget/v3/index.json. [/src/Project/ProjectName.csproj] /usr/share/dotnet/sdk/3.1.401/NuGet.targets(128,5): error : Response status code does not indicate success: 401 (Unauthorized). [/src/Project/ProjectName.csproj] The command '/bin/sh -c dotnet restore -s "https://pkgs.dev.azure.com/MYCOMPANY/_packaging/MYPROJECT/nuget/v3/index.json" "Project/ProjectName.csproj"' returned a non-zero code: 1

Dockerfile

FROM mcr.microsoft.com/dotnet/core/aspnet:3.1-buster-slim AS base
WORKDIR /app
EXPOSE 80

ENV NUGET_CREDENTIALPROVIDER_SESSIONTOKENCACHE_ENABLED true
ENV VSS_NUGET_EXTERNAL_FEED_ENDPOINTS \
"{"endpointCredentials": [{"endpoint":"https://pkgs.dev.azure.com/MYCOMPANY/_packaging/MYPROJECT/nuget/v3/index.json", "username":"USER", "password":"GENERATED_PAT"}]}"


FROM mcr.microsoft.com/dotnet/core/sdk:3.1-buster AS build
WORKDIR /src

COPY ["MyAPP.Api/MyAPP.Api.csproj", "MyAPP.Api/"]
COPY ["MyAPP.DI/MyAPP.DI.csproj", "MyAPP.DI/"]
COPY ["MyAPP.Application/MyAPP.Application.csproj", "MyAPP.Application/"]
COPY ["MyAPP.Domain/MyAPP.Domain.csproj", "MyAPP.Domain/"]
COPY ["MyAPP.Infrastructure/MyAPP.Infrastructure.csproj", "MyAPP.Infrastructure/"]

RUN dotnet restore -s "https://pkgs.dev.azure.com/MYCOMPANY/_packaging/MYPROJECT/nuget/v3/index.json" "MyAPP.Domain/MyAPP.Domain.csproj"

COPY . .
WORKDIR "/MyAPP.Api"
RUN dotnet build "MyAPP.Api.csproj" -c Release -o /app/build

FROM build AS publish
RUN dotnet publish "MyAPP.Api.csproj" -c Release -o /app/publish

FROM base AS final
WORKDIR /app
COPY --from=publish /app/publish .
ENTRYPOINT ["dotnet", "MyAPP.Api.dll"]

Answer 1

Main cause of the issue:

The dotnet restore command can't actually access the credentials you set via ENV.

You can add RUN printenv to print the ENV variables.

FROM mcr.microsoft.com/dotnet/core/aspnet:3.1-buster-slim AS base
WORKDIR /app
EXPOSE 80

ENV NUGET_CREDENTIALPROVIDER_SESSIONTOKENCACHE_ENABLED true
ENV VSS_NUGET_EXTERNAL_FEED_ENDPOINTS \
"{"endpointCredentials": [{"endpoint":"https://pkgs.dev.azure.com/MYCOMPANY/_packaging/MYPROJECT/nuget/v3/index.json", "username":"USER", "password":"GENERATED_PAT"}]}"
RUN printenv

FROM mcr.microsoft.com/dotnet/core/sdk:3.1-buster AS build
WORKDIR /src
RUN printenv

Check the log of first printenv and second printenv command and you can find the environment you run the dotnet restore can't access the credentials.

Solution:

You can move/copy the define ENV step just before the RUN dotnet restore step.

FROM mcr.microsoft.com/dotnet/core/sdk:3.1-buster AS build
WORKDIR /src

...

ENV NUGET_CREDENTIALPROVIDER_SESSIONTOKENCACHE_ENABLED true
ENV VSS_NUGET_EXTERNAL_FEED_ENDPOINTS \
"{"endpointCredentials": [{"endpoint":"https://pkgs.dev.azure.com/MYCOMPANY/_packaging/MYPROJECT/nuget/v3/index.json", "username":"USER", "password":"GENERATED_PAT"}]}"

RUN dotnet restore -s "https://pkgs.dev.azure.com/MYCOMPANY/_packaging/MYPROJECT/nuget/v3/index.json" "MyAPP.Domain/MyAPP.Domain.csproj"

Answer 2

I had the similar issue and the problem was that I was using wrong username in my nuget.config. According to your solution, the username should be MYCOMPANY.

Like so: "{"endpointCredentials": [{"endpoint":"https://pkgs.dev.azure.com/MYCOMPANY/_packaging/MYPROJECT/nuget/v3/index.json", "username":"MYCOMPANY", "password":"GENERATED_PAT"}]}"

Also, I did not need to use this. When I configured my nuget.config file like this:

<configuration>
<packageSources>
    <clear />
    <add key="MYCOMPANYNAME" value="https://pkgs.dev.azure.com/MYCOMPANY/_packaging/MYPROJECT/nuget/v3/index.json" />
    <add key="NuGet" value="https://api.nuget.org/v3/index.json" />
</packageSources>
<packageSourceCredentials>
    <Spordrift>
        <add key="Username" value="MYCOMPANY" />
        <add key="ClearTextPassword" value="GENERATED PAT*" />
    </Spordrift>
</packageSourceCredentials>
</configuration>

and my Dockerfile like this (notice that I copied nuget.config file as well):

FROM mcr.microsoft.com/dotnet/aspnet:7.0 AS base
WORKDIR /app
EXPOSE 80
EXPOSE 443

FROM mcr.microsoft.com/dotnet/sdk:7.0 AS build
COPY ["nuget.config", "./"]
COPY ["MyAPP.Api.csproj", "MyAPP/"]

RUN dotnet restore "MyAPP.Api.csproj"

COPY . .
WORKDIR "/MyAPP.Api"
RUN dotnet build "MyAPP.Api.csproj" -c Release -o /app/build

FROM build AS publish
RUN dotnet publish "MyAPP.Api.csproj" -c Release -o /app/publish

FROM base AS final
WORKDIR /app
COPY --from=publish /app/publish .
ENTRYPOINT ["dotnet", "MyAPP.Api.dll"]

everything worked as expected. I did not need to pollute my Dockerfile with a lot of configurations. nuget.config was enough to put everything in.