Skip to content

Commit

Permalink
Merge pull request github#14700 from joshspicer/patch-2
Browse files Browse the repository at this point in the history
Update allowing-your-codespace-to-access-a-private-image-registry.md
  • Loading branch information
lecoursen authored Jan 31, 2022
2 parents aacc6b5 + c443a2a commit 1b130ff
Showing 1 changed file with 4 additions and 4 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@ shortTitle: Private image registry

## About private image registries and {% data variables.product.prodname_codespaces %}

A registry is a secure space for storing, managing, and fetching private container images. You may use one to store one or more devcontainers. There are many examples of registries, such as {% data variables.product.prodname_dotcom %} Container Registry, Azure Container Registry, or DockerHub.
A registry is a secure space for storing, managing, and fetching private container images. You may use one to store one or more images. There are many examples of registries, such as {% data variables.product.prodname_dotcom %} Container Registry, Azure Container Registry, or DockerHub.

{% data variables.product.prodname_dotcom %} Container Registry can be configured to pull container images seamlessly, without having to provide any authentication credentials to {% data variables.product.prodname_codespaces %}. For other image registries, you must create secrets in {% data variables.product.prodname_dotcom %} to store the access details, which will allow {% data variables.product.prodname_codespaces %} to access images stored in that registry.

Expand Down Expand Up @@ -87,7 +87,7 @@ To access AWS Elastic Container Registry (ECR), you can provide an AWS access k
```
*_CONTAINER_REGISTRY_SERVER = <ECR_URL>
*_CONTAINER_REGISTRY_USER = <AWS_ACCESS_KEY_ID>
*_container_REGISTRY_PASSWORD = <AWS_SECRET_KEY>
*_CONTAINER_REGISTRY_PASSWORD = <AWS_SECRET_KEY>
```

You must also ensure you have the appropriate AWS IAM permissions to perform the credential swap (e.g. `sts:GetServiceBearerToken`) as well as the ECR read operation (either `AmazonEC2ContainerRegistryFullAccess` or `ReadOnlyAccess`).
Expand All @@ -97,7 +97,7 @@ Alternatively, if you don't want GitHub to perform the credential swap on your b
```
*_CONTAINER_REGISTRY_SERVER = <ECR_URL>
*_CONTAINER_REGISTRY_USER = AWS
*_container_REGISTRY_PASSWORD = <TOKEN>
*_CONTAINER_REGISTRY_PASSWORD = <TOKEN>
```

Since these tokens are short lived and need to be refreshed periodically, we recommend providing an access key ID and secret.
Expand All @@ -118,4 +118,4 @@ Some of the common image registry servers are listed below:

## Debugging private image registry access

If you are having trouble pulling an image from a private image registry, make sure you are able to run `docker login -u <user> -p <password> <server>`, using the values of the secrets defined above. If login fails, ensure that the login credentials are valid and that you have the apprioriate permissions on the server to fetch a container image. If login succeeds, make sure that these values are copied appropriately into the right {% data variables.product.prodname_codespaces %} secrets, either at the user, repository, or organization level and try again.
If you are having trouble pulling an image from a private image registry, make sure you are able to run `docker login -u <user> -p <password> <server>`, using the values of the secrets defined above. If login fails, ensure that the login credentials are valid and that you have the apprioriate permissions on the server to fetch a container image. If login succeeds, make sure that these values are copied appropriately into the right {% data variables.product.prodname_codespaces %} secrets, either at the user, repository, or organization level and try again.

0 comments on commit 1b130ff

Please sign in to comment.