Does Portainer (Agent Mode) automatically reuse docker login credentials of the (docker swarm) service?

[YuryHrytsuk]

Ask a Question!

We run a docker swarm and Portainer (Agent mode). Some of our services use images from private docker hub repositories. We deploy services, by executing docker stack deploy --with-registry-auth -c stack.yml command on Docker Swarm Node (it works). If I later try to update image of the service in Portainer, it fails to pull image (see error log coming from journalctl on the swarm node). Our Portainer has NO registries configured. All Swarm Nodes are docker logged in.

level=error msg="pulling image failed" error="pull access denied for <image>, repository does not exist or may require 'docker login': denied: requested access to the resource is denied"

Versions

• portainer/portainer-ce:2.27.6
• portainer/agent:2.27.6

Question

• Does Portainer automatically reuse docker login credentials, when updating service image in GUI (assuming below)
  • service was deployed via docker stack deploy --with-registry-auth -c stack.yml
  • each swarm node is docker logged in and has auth token in ~/.docker/config.json
• Or the portainer way to pull private images is only via creating registry in portainer (regardless of docker login on nodes, --with-registry-auth cli option, ...)

Related Issues / Discussions:

• Updating a service fails when the image is from a private registry #2341
• Deploy stacks --with-registry-auth #1313
• https://github.com/orgs/portainer/discussions/9620
• Updating a service fails when the image is from a private registry #2341
• Portainer does not take into account the ~/.docker/config.json, especially regarding proxies definition #8715

[YuryHrytsuk]

@deviantony @SvenDowideit @huib-portainer maybe 🙏

[Nick-Portainer]

@YuryHrytsuk is the image being pulled a public image? Can you please give me an example of your deployment so I can replicate

[YuryHrytsuk]

@YuryHrytsuk is the image being pulled a public image?

I am not sure I follow. The image coming from private repository on Dockerhub. So, it is private. If it was public, why would portainer fail to pull it (portainer pulls public images without problems).

Can you please give me an example of your deployment so I can replicate

1. Create a docker swarm cluster (let's say single-node)
2. Authenticate the node via docker login
3. Deploy your stack with private image via docker stack deploy --with-portainer-auth -c stack.yml my-stack
4. (Assuming portainer is deployed) Go to portainer and change image tag of the private image of the service from my-stack
5. Observe service fail to start

Notes:

• portainer has no registries defined (so anonymous dockerhub registry is used)

PS I think I more or less repeated what is written in the issue's description

[Nick-Portainer]

@YuryHrytsuk Thanks, the registry will need to be configured within Portainer to work, it will not work based on your CLI authentication. If possible it would be best to have the registry configired within Portainer and deploy the stack for your Swarm via Portainer as well to avoid this.