1

I am working with a customer using the v1.1 of IoT Edge with Windows containers. They are in a locked down environment and do not want to connect to a public container registry. They prefer to ingest from their own Azure Container Registry (ACR). We have copied edgeAgent and edgeHub from our public registry to ACR using az acr import to pull the containers from:

  • mcr.microsoft.com/azureiotedge-agent:1.1
  • mcr.microsoft.com/azureiotedge-hub:1.1

I am finding that Azure IoT Edge cannot download the edgeAgent image. If I download the edgeAgent container manually from ACR, edgeAgent will start will start correctly. edgeAgent will also be able to download and install edgeHub via ACR. eg.:

docker -H "npipe:////./pipe/iotedge_moby_engine" pull <private ACR>.azurecr.io/azureiotedge-agent:1.1

Any thoughts on why IoT Edge is unable to pull the image itself? Is there something wrong with my config.yaml configuration for edgeAgent?

agent:
  name: "edgeAgent"
  type: "docker"
  env: {}
  config:
    image: "<private ACR>.azurecr.io/azureiotedge-agent:1.1"
    auth:
      username: "<username>"
      password: "<key>"
      serveraddress: "<address>.azurecr.io"
Terry Mandin
  • 140
  • 1
  • 3
  • 11

1 Answers1

1

allow-nondistributable-artifacts may be required. Please see

Note this setting is required on the docker daemon pushing the public images to the private registry, not the IoT Edge device itself.

If that doesn't help, I'd suggest opening an issue at https://github.com/azure/iotedge/issues and be sure to include logs from the iotedged service.

Venkat Yalla
  • 558
  • 2
  • 9
  • Thanks Venkat, I will give that a try. Note that IoT Edge is able to download edgeHub once edgeAgent is manually downloaded. Wouldn't allow-nondistributable-artifacts cause an issue for edgeHub as well? – Terry Mandin Apr 26 '21 at 18:38
  • Is there a way to better protect the ACR credentials? My customer does not want to put them in open text in config.yaml. For example, is there a way to set them using environment variables? – Terry Mandin Jul 16 '21 at 13:12
  • The only way currently is using scoped credentials (e.g. read only) for container registry using service principals or tokens. You could also try pre-loading the bootstrap edgeAgent image using 'docker import'. – Venkat Yalla Jul 19 '21 at 20:23