Unauthorized error when build docker image with jib, using a custom base image

Question

I've to create a docker image, starting from a distroless base image, with some custom files. I use JIB with maven on my spring boot project. I'm working on Windows 7 with Docker toolbox. this is the step than I do for now:

1) create Dockerfile with these entries:

FROM gcr.io/distroless/java:8
COPY known_hosts  ~/.ssh/known_hosts
EXPOSE 8888

2) execute the command:

docker build -t conf_server_image .

3) added follow lines on pom.xml:

          <plugin>
              <groupId>com.google.cloud.tools</groupId>
              <artifactId>jib-maven-plugin</artifactId>
              <version>2.1.0</version>
              <configuration>
                <from>
                    <image>conf_server_image:latest</image>
                </from>
                <to>
                  <image>${project.artifactId}:${project.version}</image>
                </to>
                <container>
                    <jvmFlags>
                        <jvmFlag>-Xms512m</jvmFlag>
                        <jvmFlag>-Xmx512m</jvmFlag>
                    </jvmFlags>
                </container>
              </configuration>
            </plugin>

4) execute command (with my ID ad pwd of docker.io):

docker login

4) execute the build command

mvnw clean compile jib:dockerBuild

but the process return me this error:

[INFO] Executing tasks:
[INFO] [============                  ] 40,0% complete
[INFO] > building image to Docker daemon
[INFO]
[INFO] ------------------------------------------------------------------------
[INFO] BUILD FAILURE
[INFO] ------------------------------------------------------------------------
[INFO] Total time:  12.941 s
[INFO] Finished at: 2020-04-10T11:26:59+02:00
[INFO] ------------------------------------------------------------------------
[ERROR] Failed to execute goal com.google.cloud.tools:jib-maven-plugin:2.1.0:dockerBuild (default-cli) on project sirio-configuration-server: Build to Docker daemon failed, pe
haps you should make sure your credentials for 'registry-1.docker.io/library/conf_server_image' are set up correctly. See https://github.com/GoogleContainerTools/jib/blob/mast
r/docs/faq.md#what-should-i-do-when-the-registry-responds-with-unauthorized for help: Unauthorized for registry-1.docker.io/library/conf_server_image: 401 Unauthorized
[ERROR] {"errors":[{"code":"UNAUTHORIZED","message":"authentication required","detail":[{"Type":"repository","Class":"","Name":"library/conf_server_image","Action":"pull"}]}]}
[ERROR] -> [Help 1]
[ERROR]

what am i forgetting? Thanks

Answer 1

File settings.xml inside .m2 folder should look like:

<?xml version="1.0" encoding="UTF-8"?>
<settings xmlns="http://maven.apache.org/SETTINGS/1.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  xsi:schemaLocation="http://maven.apache.org/SETTINGS/1.0.0 https://maven.apache.org/xsd/settings-1.0.0.xsd">
    <servers>
      <server>
        <id>registry-1.docker.io</id>
        <username>YOUR_DOCKER_HUB_USERNAME</username>
        <password>YOUR_DOCKER_HUB_PASSWORD</password>
      </server>
    </servers>
 </settings>

Reference: https://maven.apache.org/settings.html

Answer 2

conf_server_image:latest as an image reference points to Docker Hub (alias for library/conf_server_image:latest). For example, in Dockerfile, when you say

FROM openjdk:11-jre-slim

Docker CLI downloads the openjdk image on Docker Hub.

$ docker pull openjdk:11-jre-slim
11-jre-slim: Pulling from library/openjdk
...

Note the image reference library/openjdk.

To make Jib load the image in your local Docker daemon, you should say <image>docker://conf_server_image:latest</image>. However, using an image from a Docker daemon incurs some overhead (which may be negligible). So, it may be better to push the base image to any container registry (a local private registry can work too) and have Jib use the image. Jib does cache base images, so using an image in a registry doesn't mean Jib will download it over and over. (But of course, if an image pointed to by a tag is updated, Jib will automatically download the updated image.)

There is another option where you can just get rid of the first Dockerfile step. Jib allows adding any arbitrary files into the image through the <extraDirectories> feature. The default directory is src/main/jib, so for example, if you place src/main/jib/foo/bar.txt, your will have /foo/bar.txt in the built image. However, I understand that you may not want to put a personal known_hosts into the source repo. (Potentially, you could set up a special dev Maven profile that, for example, copies known_hosts into src/main/jib using the copy-resources goal from the Maven Resources plugin.)

You can also set some container configurations including ports in Jib.

<configuration>
  <container>
    ...
    <ports>
      <port>8888</port>
    </ports>
  </container>
</configuration>

Lastly, because you are using jib:dockerBuild which builds , I think docker login is unnecessary.

Answer 3

You are trying to push your image to repository registry-1.docker.io

Change this section:

  <to>
     <image>${project.artifactId}:${project.version}</image>
  </to>

to:

<to>
  <image>yourDockerHubRepositoryName/${project.artifactId}:${project.version}</image>
</to>