Using ACR across subscriptions with Web App for Containers fails

[ThomasPe]

Describe the bug
I'm unable to get image from ACR in app service that lives in a different subscription.

To Reproduce
Steps to reproduce the behavior:

1. Create ACR in one subscription, add container
2. Add Web App for Containers in another subscription
3. Since the ACR won't show up in the Web App dropdown menu, enter connection details in private registry tab and save
4. Exit and re-enter container settings
5. The settings were moved to the Azure Container Registry tab and are not working => no image is being deployed

Expected behavior
The settings should stay in the private registry tab and a container should be pulled from ACR.

Any relevant environment information

• Azure Portal

Additional context
Issue is also being discussed here: microsoft/vscode-docker#743

[tomkerkhove]

This is more an issue with Azure Web Apps, not ACR.

In order to fix this you have to configure the following config values:

• DOCKER_REGISTRY_SERVER_URL
• DOCKER_REGISTRY_SERVER_USERNAME
• DOCKER_REGISTRY_SERVER_PASSWORD

[ThomasPe]

When you add these values pointing to an ACR and hit save those values are being cleared from the private registry tab and it is not working.
Adding them manually to the Application Config does not work either.

[tomkerkhove]

Works fine for all our customers but I'd suggest opening an issue with App Service folks instead, they own that feature.

[ThomasPe]

I opened a ticket here as well, hope that's the correct place for web app feedback since there seems no place on GitHub for this:
https://docs.microsoft.com/answers/questions/10008/using-acr-across-subscriptions-with-web-app-for-co.html

[iamjasonp]

Sorry, misclicked there just now 00Kai0

[00Kai0]

never mind

[wsmckenz]

Exact same problem. Cannot figure this out at all.

[justinpitcher]

In case this helps anybody, I ran into the same issue but was able to overcome it by a combination of the login credential configuration values mentioned above + an Azure Pipelines release task that sets the registry/image and restarts the app service.

[krispenner]

To get the image to deploy enter the full URL of the image but without the https:// in front, not just a relative path from the server URL. So I had to enter it twice. The below settings worked for a deployment of the container. At first I was using a relative path from the server URL but then it tries to get the image from docker hub instead. After the deployment it cleared all the fields as well so that is annoying but at least the deployment worked. Hope this might help someone get their deployment working.

App settings:

Container settings:

[jonasmiederer]

Thanks @krispenner, that solved it for me.

I lost so much time on this wondering why my container isn't getting pulled. Please Azure Team fix this (why do I have to enter the full URL again if it's already given above and the label only tells me to enter the image name) or document it somewhere.

[florianfischerx]

+1
The UI for this very basic use-case is completely broken at the moment.

[yugangw-msft]

We have communicated the feedback to the AppService team which owns the portal UI and service backend.
Since this is not an ACR specific issue, we are closing it

[MaxMommersteeg]

We ran into the same problem that @krispenner had.

We tried using the preview version of the Azure Portal and that fixed the issue for us.

[alexanderkyte]

This issue appears to still be open. When I do this deployment entirely from the command-line, it fails to authenticate when I use an ACR in another subscription.

[SteveLasker]

@ccompy can you help with app services configuration?

[btardif]

@SteveLas you can assign this to me here is the current state:

I have a doc update coming up shortly that cover this cross subscription scenario
We have UX updates that will add support for cross sub ACR in the next quarter.

[SteveLasker]

Excellent, thanks @btardif

[SteveLasker]

@btardif, is there an App Service repo of issues we can transfer this to?
Folks still find this, even if closed. It would be great to transfer to App Service and activate until resolved.

[btardif]

We don't track App Service issues on GitHub, next best thing would be our uservoice

but since folks are coming here that's why I wanted to use it for updates.

[ggirard07]

@btardif Is this released?
The documentation I was pointed by support is this one, which states this is not currently supported.

[btardif]

@ggirard07 yes it's supported.

doc have also been expanded a bit:

https://github.com/Azure/app-service-linux-docs/tree/master/HowTo/Configure%20ACR%20with%20Managed%20Identities