Hello again I m trying to understand an issue I encountered

Question

Hello again I m trying to understand an issue I encountered today in pushing a docker image on Jenkins Pipeline where `pants publish` returned an error denied requested access to the resource is denied from docker cli Meanwhile a plain `docker push` worked just fine My Jenkinsfile wraps the `pants publish` step inside <https www jenkins io doc pipeline steps docker workflow withdockerregistry sets up docker registry endpoint|withDockerRegistry> The urls specified in withDockerRegistry and in ` docker registry private name address` are identical though Pipeline plugin requires a protocol prefix whereas pants doesn t In our Pipeline we use a separate credentials to login and push the image and that account is different from the pipeline runner i e `$USER` The last thing worth mentioning is that the docker images were built prior to entering withDockerRegistry meaning that they were built under the name of `$USER` Am I doing something wrong perhaps

curved-television-6568 · Answer

Hi and thanks for the report I ll take a look see what I can find

curved-television-6568 · Answer

I think the issue is with not locating the `~ docker config json` properly This may very well be a bug in our docker backend I ll investigate further but it ll be some time

curved-television-6568 · Answer

OK I ve double checked on a Linux Ubuntu system that with a properly setup `docker` client ` pants publish lt docker image gt ` works when running from the command line with properly setup here I refer to there being a successfully issued `docker login` for the registry you want to push to I ve not had the opportunity to test running a Jenkins pipeline with the docker plugin you mention but it feels like it could be in proximity there abouts It should not matter which user built the image however

curved-television-6568 · Answer

gt Meanwhile a plain `docker push` worked just fine Was this also executed from within the `withDockerRegistry` step

happy-pizza-30507 · Answer

sorry for the late reply slack is restricted in the firm Yes the plain docker run is executed from within the withDockerRegistry step Thanks for the hint about docker confit location I ll add some diagnostics to check that on the Jenkins run

happy-pizza-30507 · Answer

< curved television 6568> it turns out that the particular step exports DOCKER CONFIG which points to a different location than ~ docker I made a failed attempt to inject the environment variable via specifying subprocess environment env vars add = DOCKER CONFIG I guess I should specify that variable somewhere else but can t find any from the documentation In the meantime I can confirm that pants publish works by adding a symlink to $DOCKER CONFIG

curved-television-6568 · Answer

Could you try with <https www pantsbuild org docs reference docker section env vars> If you provide just the name it will pick the value from the environment invoking pants

happy-pizza-30507 · Answer

Thanks for the info However with ldebug I can t find the env being populated in docker push command in fact I can t find docker push being wrapped unter any Process either On the other hand that env var does get populated in the docker build step I m using 2 8 0rc4

curved-television-6568 · Answer

Arrgh You re absolutely right Sorry my bad That env is not passed to `docker publish` but it should be that was my intention overlooked Will fix sorry for the trouble

curved-television-6568 · Answer

Regarding not seeing the process I think that is due to it being an interactive process running in the foreground so it isn t logged the same as for other processes

curved-television-6568 · Answer

curved-television-6568 · Answer

Pushed bugfix waiting for it to land will let you know when there is a rc out to try or try bleeding edge if you re adventurous using `PANTS SHA` for a commit from `main` after it s been merged

happy-pizza-30507 · Answer

Thanks for the quick turnaround No trouble at all it s also a great experience for me to trace the tool s diagnostics in more depth and learnt quite a bit I m happy to try the edge build when I get back to work tomorrow

curved-television-6568 · Answer

< happy pizza 30507> There s now a 2 9 0 dev2 out with this fix in

happy-pizza-30507 · Answer

Thanks < curved television 6568> I have tried it and it looks good

curved-television-6568 · Answer

Thanks great +1 skin tone 4