0

I am trying to download an image from the Google container registry in a CoreOS machine running in other server (not GCE).

I configured a new service account:

core@XXXX ~ $ docker run -t -i -v $(pwd)/keys:/tmp/keys --name gcloud-config ernestoalejo/google-cloud-sdk-with-docker gcloud auth activate-service-account XXXXXXX@developer.gserviceaccount.com --key-file /tmp/keys/key.p12 --project XXXX
Activated service account credentials for: [XXXXXXX@developer.gserviceaccount.com]

The account is active, but when I try to download the container image it returns a forbidden HTTP status.

core@XXXX ~ $ /usr/bin/docker run --volumes-from gcloud-config --rm -v /var/run/docker.sock:/var/run/docker.sock ernestoalejo/google-cloud-sdk-with-docker sh -c "gcloud preview docker pull gcr.io/XXXXX/influxdb"
Pulling repository gcr.io/XXXXX/influxdb
time="2015-05-08T06:38:55Z" level="fatal" msg="HTTP code: 403" 
ERROR: (gcloud.preview.docker) A Docker command did not run successfully.
Tried to run: 'docker pull gcr.io/XXXXX/influxdb'
Exit code: 1

There is only one account in the server and is correctly configured:

core@XXXX ~ $ /usr/bin/docker run --volumes-from gcloud-config --rm -v /var/run/docker.sock:/var/run/docker.sock ernestoalejo/google-cloud-sdk-with-docker sh -c "gcloud auth list"

To set the active account, run:
  $ gcloud config set account ``ACCOUNT''

Credentialed accounts:
 - XXXXXXXXXXXXX@developer.gserviceaccount.com (active)

How can I authorize the external machine to download images from the registry?

NOTE: The image ernestoalejo/google-cloud-sdk-with-docker is the same as google/cloud-sdk but with this issue fixed.

UPDATE: I have also tried the solution of this answer, but it makes no difference.

PROJECT_ID=XXXXXX
ROBOT=XXXXXX@developer.gserviceaccount.com
gsutil acl ch -u $ROBOT:R gs://artifacts.$PROJECT_ID.appspot.com
gsutil -m acl ch -R -u $ROBOT:R gs://artifacts.$PROJECT_ID.appspot.com
gsutil defacl ch -u $ROBOT:R gs://artifacts.$PROJECT_ID.appspot.com
Community
  • 1
  • 1
ernestoalejo
  • 853
  • 1
  • 12
  • 23

1 Answers1

0

It seems that the new Frankfurt region of Digital Ocean can't access the Google Container Registry at all. It always returns a 403 Forbidden. As soon as I used a server in London everything started working.

ernestoalejo
  • 853
  • 1
  • 12
  • 23
  • Can you "curl https://gcr.io/v1/_ping" from Frankfurt? That endpoint is unauthenticated, so a 403 should only mean we think your traffic is somewhat more fundamentally forbidden (e.g. coming from North Korea). I'll reach out to see if others have seen anything like this, thanks for the heads up. – mattmoor May 09 '15 at 00:34
  • I think I have somehow reached "https://gcr.io/v1/_ping"; but now that I am trying again I can't even reach "gcr.io". It always returns a "Error 403 (Forbidden)!!1" HTML page. – ernestoalejo May 09 '15 at 05:57