4

I want to remove some unwanted tags/images from various repositories of azure container registry. I want to do all these programmatically. For example, what I need is:

  • Authenticate with ACR
  • List all repositories
  • List all tags of each repository
  • Remove unwanted images with particular tags.

Normally these operations can be done using Azure CLI and az acr commands. Maybe I can create a PowerShell script with az acr commands to accomplish this.

But can I do this with python? Is there something like Graph API to do these operations?

I found this API for ACR but allows to only delete entire registry. It doesn't allow repository-specific operations: https://learn.microsoft.com/en-us/rest/api/containerregistry/

I tried with docker registry API: https://docs.docker.com/registry/spec/api/

#!/bin/bash

export registry="myregistry.azurecr.io"
export user="myusername"
export password="mypassword"

export operation="/v2/_catalog"

export credentials=$(echo -n "$user:$password" | base64 -w 0)

export catalog=$(curl -s -H "Authorization: Basic $credentials" https://$registry$operation)
echo "Catalog"
echo $catalog

But an error is returned all the time:

{"errors":[{"code":"UNAUTHORIZED","message":"authentication required","detail":[{"Type":"registry","Name":"catalog","Action":"*"}]}]}

How can I properly authenticate with ACR before using Docker registry API?

AnjK
  • 2,887
  • 7
  • 37
  • 64

2 Answers2

3

For authenticate to the ACR, you can just use the Basic Authentication method with the user and password. And the format should like this:

curl -v -u $user:$passwd https://yourACRName.azurecr.io:443/v2/_catalog

For the user and password, I will suggest you use the service principal to authenticate. You can follow the steps in Azure Container Registry authentication with service principals. Take a look at the roles for the ACR. The Contributor role is the appropriate one with enough permission to List all repositories, List all tags of each repository and Remove unwanted images with particular tags. The admin credential is not recommended because of the admin permission.

Charles Xu
  • 29,862
  • 2
  • 22
  • 39
  • Thanks. The basic authentication works with the username and password created for ACR in the access keys section. I hope the service principal will also work. I haven't tried it yet. – AnjK Sep 02 '19 at 09:53
  • @AnjanaDyna Yeah, it also works. Actually, the service principal works like the user and password. – Charles Xu Sep 03 '19 at 01:10
  • @CharlesXu Not relevant to this question. Can you have a look at my question related to acr [here](https://stackoverflow.com/questions/73544528/how-to-update-security-patches-in-azure-container-registry-automatically) in your free time? – shaik moeed Aug 31 '22 at 08:51
1

This answer to this question has a sample to help with deleting: Azure Container Registry - delete all images except 2

Basic authentication should work when using an admin users credentials.

Nathan Anderson
  • 11
  • 2