2

In Ubuntu-22, google-cloud has been installed through snap store;

> whereis gcloud
gcloud: /snap/bin/gcloud
> snap list | grep google
google-cloud-sdk           432.0.0                     346    latest/stable    google-cloud-sdk**  classic

Docker has been installed via snap too;

> snap list | grep docker
docker                     20.10.24                    2893   latest/stable    canonical**

And I have authenticated my account to a private GCR as below;

> gcloud auth login
Your browser has been opened to visit:

    https://accounts.google.com/o/oauth2/auth?...<long_url>


You are now logged in as [<my_email@address.com>].
Your current project is [<desired_project_name>].  You can change this setting by running:
  $ gcloud config set project PROJECT_ID

Double-checked the login process;

> gcloud auth list
           Credentialed Accounts
ACTIVE             ACCOUNT
*                  <my_email@address.com>

To set the active account, run:
    $ gcloud config set account `ACCOUNT`

But, when I try to pull or push any image, I hit the following permission issue;

unauthorized: You don't have the needed permissions to perform this operation, and you may have invalid credentials. To authenticate your request, follow the steps in: https://cloud.google.com/container-registry/docs/advanced-authentication

I am able to access to the image which I try to pull from the private GCR in my browser, this makes me think that it is an issue related to creds while performing docker pull in my terminal.

What am I missing here?

PS: The solution in this question did not work for me Unable to push to Google Container Registry - Permission issue

EDIT:

As it is asked in the comments, I need to mention that I have performed one more step before auth login which is gcloud auth configure-docker as below;

> gcloud auth configure-docker
Adding credentials for all GCR repositories.
WARNING: A long list of credential helpers may cause delays running 'docker build'. We recommend passing the registry name to configure only the registry you are using.
After update, the following will be written to your Docker config file located at 
[/home/<user>/.docker/config.json]:
 {
  "credHelpers": {
    "gcr.io": "gcloud",
    "us.gcr.io": "gcloud",
    ...
  }
}

Do you want to continue (Y/n)?  

Docker configuration file updated.
Sercan
  • 2,081
  • 2
  • 10
  • 23
  • Did you run the command `gcloud auth configure-docker`? https://cloud.google.com/sdk/gcloud/reference/auth/configure-docker – John Hanley Jun 01 '23 at 15:16
  • @JohnHanley yes I did, it created `~/.docker/config.json` with `credHelpers`, but the issue persisted. I have removed snap installation and installed the docker with package manager, authenticated again, it worked. I am trying to understand the reason – Sercan Jun 01 '23 at 15:29
  • Is the problem that Docker installed via snap does not work with gcloud but does work when installed with a package manager? – John Hanley Jun 01 '23 at 15:35
  • @JohnHanley yes. Somehow I was not able to authenticate the Docker which is installed with snap store, but after installing it with package manager all worked fine. And the difference I have noticed between two; with snap when `gcloud auth login` directs me to browser, it only asked me to choose desired google account on the browser and then it said auth is success, but.. when I was directed to the browser after package manager installation, I chose my account and it gave me a key to enter it in terminal – Sercan Jun 01 '23 at 15:43
  • @JohnHanley just to clarify, when I asked the main question, I did not know that installing Docker with package manager works. So, snap vs apt is current question for me. – Sercan Jun 01 '23 at 16:04
  • This appears to be a bug with how Docker is installed via snap and something internal to gcloud. – John Hanley Jun 01 '23 at 16:06
  • @JohnHanley thank you for taking a look at it, I am appreciated. Checking the outputs now again, as I said the difference is `authorization code`. Please look at 3rd code block in my question, it authed me without any code, but later on with `apt` installation, it asked me to provide `Enter authorization code:` which I found in browser. – Sercan Jun 01 '23 at 16:10
  • At this [link](https://snapcraft.io/install/docker/ubuntu) I found this comment: **Additional certificates used by the Docker daemon to authenticate with registries need to be added in /var/snap/docker/current/etc/docker/certs.d (instead of /etc/docker/certs.d). This directory can be accessed by other snaps using the docker-registry-certificates content interface.**. – John Hanley Jun 01 '23 at 16:16
  • So, is the problem Docker has different config location in `snap` vs `apt` installations and it requires additional actions (creating a symlink) when it comes to auth for private registry with `snap`? – Sercan Jun 01 '23 at 16:22
  • @JohnHanley I forgot to tag you in my last comment/question – Sercan Jun 01 '23 at 17:31
  • 1
    I do not normally use snap, so I don't know. I have noticed comments regarding issues using snap. Even Docker recommends removing previous installations and using apt. – John Hanley Jun 01 '23 at 17:37

2 Answers2

1

Posting this as a community wiki for everyone's visibility.

The permission issue with the docker was resolve by re-installing the docker with APT package manager. As said by John Hanley, the issue appears to be a bug with how the Docker was installed via snap. Using APT to install Docker is recommended by Docker themselves.

Its also important to note that you should always remove/uninstall previous installations. According to this post, its also recommended to use either snap or apt all the way, as they can't co-exist.

Michael C
  • 308
  • 1
  • 6
1

Removing snap installation and installing docker with package manager apt has fixed my issue.

The difference I have observed between two installations;

  • With snap, once gcloud auth login directs me to browser, authentication was completed by choosing google account only (Please see the 3rd code block in my question, no authorization code was asked).
  • With apt, after choosing the desired google account, I was directed to another page where the authorization code was provided which needed to be entered in the terminal;
> gcloud auth login
Your browser has been opened to visit:

    https://accounts.google.com/o/oauth2/auth?...<long_url>

Enter authorization code: <Code_from_browser>  // This is the difference!!

You are now logged in as [<my_email@address.com>].
Your current project is [<desired_project_name>].  You can change this setting by running:
  $ gcloud config set project PROJECT_ID

Thank you @JohnHanley pointed out that docker recommends apt installation.

Sercan
  • 2,081
  • 2
  • 10
  • 23