No such image [...] when deploying a container based on a template, from a custom registry

[ericmorand]

Ask a Question!

I'm not sure if this is a bug or a misconfiguration of my template, but I can't seem to be able to have an image hosted in a custom registry pulled automatically when deploying a container from a template. I always end up having the "No such image [...]" error triggered when I try to deploy my container.

Here is the relevant information from the templates.json file that is used by Portainer to gather the list of templates:

{
    "version": "3",
    "templates": [
        {
            "type": 1,
            "title": "Foo Bar",
            "description": "Foo Bar",
            "categories": [
                "foo",
                "bar"
            ],
            "platform": "linux",
            "registry": "registry-gitlab.example.com",
            "image": "registry-gitlab.example.com/eric_morand/foo-bar/foo-bar:latest"
       }
    ]
}

The custom registry registry-gitlab.example.com is confirmed to be working:

And pulling the image manually from the Images UI also works perfectly:

Which confirms that the registry is setup properly - i.e. with the proper URLs, username and access token.

Which makes me think that, either:

• My template's registry and image URLs are not correct
• Portainer is not able to pull an image from a custom registry when it needs to deploy a container from a template

I've tried multiple combinations of registry and image values, without any success.

If someone has an idea, I would love to hear about it.

EDIT: After further investigation, it seems like Portainer is executing a HEAD request to the following URL to get the image manifest:

https://registry-gitlab.[...].com/v2/eric_morand/[...]/manifests/1.5.0

Which seems legit, except it returns a 403 which, I suspect, is because Portainer does not send the authorization header.

[Nick-Portainer]

@ericmorand Does this work for you if you deploy it directly as a Stack rather than a template?

[ericmorand]

Interesting. It does. I've used the following simplest possible compose manifest to deploy a stack.

services:
  foo:
    image: registry-gitlab.example.com/eric_morand/foo-bar/foo-bar:latest

(Note that I'm using registry-gitlab.example.com as a placeholder for the actual URL of the private registry)

I checked beforehand that the image was not present in the host, and I can confirm that the stack was deployed successfully and that the image is now present in the host - i.e. it was pulled successfully.

To further confirm that it is not a false positive, I removed the stack, the image, and the registry. And I attempted to deploy the stack once again, using the same compose manifest. And this time, as expected, it failed with a forbidden error, because the private registry is not registered into Portainer:

Deployment error
Failed to deploy a stack: compose up operation failed: Error response from daemon: Head "https://registry-gitlab.example.com/v2/eric_morand/foo-bar/foo-bar/manifests/latest": denied: access forbidden