entityMap|blocks|key|d9luq|text|我找到的最好的解决方案是在Docker主机上进行身份验证，然后将docker配置挂载到docker-compose容器中：|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|23bdk|docker+login+-u+_json_key+-p+"$(cat+keyfile.json)"+https://gcr.io
docker+run+\
++++-v+/var/run/docker.sock:/var/run/docker.sock+\
++++-v+/root/.docker:/root/.docker+\
++++-v+"$PWD:$PWD"+\
++++-w="$PWD"+\
++++docker/compose:1.14.0+\
++++up|code-block|syntax|javascript|24cph^0|17|E|0|0^^$0|$]|1|@$2|3|4|5|6|7|8|M|9|@$A|N|B|O|C|D]]|E|@]|F|$]]|$2|G|4|H|6|I|8|P|9|@]|E|@]|F|$J|K]]|$2|L|4|-4|6|7|8|Q|9|@]|E|@]|F|$]]]]

The best solution I found was to authenticate on the Docker host and then mount the docker config into the <code>docker-compose</code> container:

<pre><code>docker login -u _json_key -p "$(cat keyfile.json)" https://gcr.io
docker run \
 -v /var/run/docker.sock:/var/run/docker.sock \
 -v /root/.docker:/root/.docker \
 -v "$PWD:$PWD" \
 -w="$PWD" \
 docker/compose:1.14.0 \
 up
</code></pre>

entityMap|0|type|LINK|mutability|MUTABLE|data|url|https://cloud.google.com/container-registry/docs/advanced-authentication|blocks|key|891lt|text|使用来自GCR's+advanced+authentication+docs的_json_key验证，下面的脚本可以工作吗？|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|8dt3m|docker+run+\+++++-v+/var/run/docker.sock:/var/run/docker.sock+\+++++-v+"$PWD:/rootfs/$PWD"+\+++++-w="/rootfs/$PWD"+\+++++docker/compose:1.14.0+\+++++/bin/bash+-c+"docker+login+-u+_json_key+-p+$(cat+keyfile.json)+https://gcr.io;+up"|style|CODE|fkroq^0|4|Y|0|0|0|6F|0^^$0|$1|$2|3|4|5|6|$7|8]]]|9|@$A|B|C|D|2|E|F|P|G|@]|H|@$I|Q|J|R|A|S]]|6|$]]|$A|K|C|L|2|E|F|T|G|@$I|U|J|V|M|N]]|H|@]|6|$]]|$A|O|C|-4|2|E|F|W|G|@]|H|@]|6|$]]]]

Using the _json_key anthentication from <a href="https://cloud.google.com/container-registry/docs/advanced-authentication" rel="nofollow noreferrer">GCR's advanced authentication docs</a>, does the following script work?

<code>docker run \
 -v /var/run/docker.sock:/var/run/docker.sock \
 -v "$PWD:/rootfs/$PWD" \
 -w="/rootfs/$PWD" \
 docker/compose:1.14.0 \
 /bin/bash -c "docker login -u _json_key -p $(cat keyfile.json) https://gcr.io; up"
</code>

entityMap|0|type|LINK|mutability|MUTABLE|data|url|https://cloud.google.com/container-registry/docs/advanced-authentication#using_a_json_key_file|blocks|key|eq802|text|您希望使用this方法进行身份验证。|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|85vtl^0|5|4|0|0^^$0|$1|$2|3|4|5|6|$7|8]]]|9|@$A|B|C|D|2|E|F|L|G|@]|H|@$I|M|J|N|A|O]]|6|$]]|$A|K|C|-4|2|E|F|P|G|@]|H|@]|6|$]]]]

You want to use <a href="https://cloud.google.com/container-registry/docs/advanced-authentication#using_a_json_key_file" rel="nofollow noreferrer">this</a> method to authenticate.

entityMap|blocks|key|6os69|text|如果COS虚拟机已经被授权访问注册表(例如，附加的服务账号拥有托管镜像的项目的GCS视图访问权限)，则可以选择直接使用服务账号JSON凭证，即运行COS附带的/usr/share/google/dockercfg_update.sh脚本：|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|8nd3i|#!/bin/sh
#+Copyright+2015+The+Chromium+OS+Authors.+All+rights+reserved.
#+Use+of+this+source+code+is+governed+by+a+BSD-style+license+that+can+be
#+found+in+the+LICENSE+file.

set+-eu

AUTH_DATA="$(curl+-s+-f+-m+10+"http://metadata/computeMetadata/v1/instance/service-accounts/default/token"+\
++-H+"Metadata-Flavor:+Google")"
R=$?
if+[+${R}+-ne+0+];+then
++echo+"curl+for+auth+token+exited+with+status+${R}"+>&2
++exit+${R}
fi

AUTH="$(echo+"${AUTH_DATA}"+\
%7C+tr+-d+'{}'+\
%7C+sed+'s/,/\n/g'+\
%7C+awk+-F+':'+'/access_token/+{+print+"_token:"+$2+}'+\
%7C+tr+-d+'"\n'+\
%7C+base64+-w+0)"

if+[+-z+"${AUTH}"+];+then
++echo+"Auth+token+not+found+in+AUTH_DATA+${AUTH_DATA}"+>&2
++exit+1
fi

D="${HOME}/.docker"
mkdir+-p+"${D}"
cat+>+"${D}/config.json"+<<EOF
{
+"auths":{
++"https://container.cloud.google.com":{"auth":+"${AUTH}"},
++"https://gcr.io":{"auth":+"${AUTH}"},
++"https://b.gcr.io":{"auth":+"${AUTH}"},
++"https://us.gcr.io":{"auth":+"${AUTH}"},
++"https://eu.gcr.io":{"auth":+"${AUTH}"},
++"https://asia.gcr.io":{"auth":+"${AUTH}"},
++"https://beta.gcr.io":{"auth":+"${AUTH}"}
+}
}
EOF|code-block|syntax|javascript|6suar|这具有由Google维护的好处，并且避免了必须管理服务帐户凭据。|27vnn^0|27|11|0|0|0^^$0|$]|1|@$2|3|4|5|6|7|8|O|9|@$A|P|B|Q|C|D]]|E|@]|F|$]]|$2|G|4|H|6|I|8|R|9|@]|E|@]|F|$J|K]]|$2|L|4|M|6|7|8|S|9|@]|E|@]|F|$]]|$2|N|4|-4|6|7|8|T|9|@]|E|@]|F|$]]]]

An alternative to directly using the service account JSON credentials, given the COS VM is already authorized to access the registry (e.g. the attached service account has GCS view access to the project hosting the image), is to run the <code>/usr/share/google/dockercfg_update.sh</code> script shipped with COS:

<pre><code>#!/bin/sh
# Copyright 2015 The Chromium OS Authors. All rights reserved.
# Use of this source code is governed by a BSD-style license that can be
# found in the LICENSE file.

set -eu

AUTH_DATA="$(curl -s -f -m 10 "http://metadata/computeMetadata/v1/instance/service-accounts/default/token" \
 -H "Metadata-Flavor: Google")"
R=$?
if [ ${R} -ne 0 ]; then
 echo "curl for auth token exited with status ${R}" &gt;&amp;2
 exit ${R}
fi

AUTH="$(echo "${AUTH_DATA}" \
| tr -d '{}' \
| sed 's/,/\n/g' \
| awk -F ':' '/access_token/ { print "_token:" $2 }' \
| tr -d '"\n' \
| base64 -w 0)"

if [ -z "${AUTH}" ]; then
 echo "Auth token not found in AUTH_DATA ${AUTH_DATA}" &gt;&amp;2
 exit 1
fi

D="${HOME}/.docker"
mkdir -p "${D}"
cat &gt; "${D}/config.json" &lt;&lt;EOF
{
 "auths":{
 "https://container.cloud.google.com":{"auth": "${AUTH}"},
 "https://gcr.io":{"auth": "${AUTH}"},
 "https://b.gcr.io":{"auth": "${AUTH}"},
 "https://us.gcr.io":{"auth": "${AUTH}"},
 "https://eu.gcr.io":{"auth": "${AUTH}"},
 "https://asia.gcr.io":{"auth": "${AUTH}"},
 "https://beta.gcr.io":{"auth": "${AUTH}"}
 }
}
EOF
</code></pre>

This has the benefits of being maintained by Google and avoids having to manage service account credentials.

I'm running a <a href="https://cloud.google.com/container-optimized-os/" rel="nofollow noreferrer">Container-Optimized OS</a> VM on GCE (with Docker 17.03.2) and would like to use <code>docker-compose</code> to manage the containers. <code>docker-compose</code> isn't installed on COS, but it can be run from a container using the image <a href="https://hub.docker.com/r/docker/compose/" rel="nofollow noreferrer">docker/compose</a>, as described in <a href="https://cloud.google.com/community/tutorials/docker-compose-on-container-optimized-os" rel="nofollow noreferrer">this tutorial</a>:

<pre><code>docker run \
 -v /var/run/docker.sock:/var/run/docker.sock \
 -v "$PWD:/rootfs/$PWD" \
 -w="/rootfs/$PWD" \
 docker/compose:1.14.0 up
</code></pre>

The images I want to access are in a private Google Container Registry, which requires a <code>docker login</code> for pull access. How can I run the docker/compose image to access the private registry?

The COS VM is already authorized to access the registry, and I have a service account JSON file on the VM, but can that be passed to the compose image to login before running the <code>up</code> command?

Accessing private Google Container Registry from docker/compose container running on COS

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

学习中心

腾讯云实验室

直播

竞赛

腾讯云代码分析专区

腾讯iOA零信任安全管理系统专区

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋

腾讯云代码助手

云原生构建

TAPD 敏捷项目管理

Cloud Studio

SDK中心

API中心

命令行工具

涵盖代码开发、场景应用、自动测试全流程，助你从零构建专属AI助手

一站式MCP教程库，解锁AI应用新玩法

 我在GCE (带有Docker17.03.2)上运行Container-Optimized OS虚拟机，并希望使用docker-compose来管理容器。docker-compose没有安装在对象存储上，但可以使用镜像docker/compose从容器中运行，如this tutorial中所述 docker run \    -v /var/run/docker.sock:/var/run/do

问从COS上运行的docker/compose容器访问私有Google Container Registry
EN

回答 4

Stack Overflow用户

Stack Overflow用户

Stack Overflow用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问从COS上运行的docker/compose容器访问私有Google Container RegistryEN

回答 4

Stack Overflow用户

Stack Overflow用户

Stack Overflow用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问从COS上运行的docker/compose容器访问私有Google Container Registry
EN