构建 docker 映像时无法在 Azure DevOps (Artifacts) 中授权

Question

我在 Azure DevOps 中有 Artifacts 并尝试创建 docker build。

• 平台：Microsoft .NET Core 3.1
• Docker（本地）：19.03.12

我做的步骤：

1. 在 Azure DevOps 中创建了一个 PAT（具有完全权限）
2. 使用 Visual Studio 2019 生成 Dockerfile
3. 在 Dockerfile 中添加：

ENV VSS_NUGET_EXTERNAL_FEED_ENDPOINTS
"{"endpointCredentials": [{"endpoint":"https://pkgs.dev.azure.com/MYCOMPANY/_packaging/MYPROJECT/nuget/v3/index.json", "用户名":"USER", "密码":"GENERATED_PAT"}]}"

4. 添加 COPY 命令后：

运行 dotnet restore -s "https://https://pkgs.dev.azure.com/MYCOMPANY/_packaging/MYPROJECT/nuget/v3/index.json" "Project/ProjectName.csproj"

但我在运行时收到“未经授权”错误： docker build 。 -t mydockerfile:v1

/usr/share/dotnet/sdk/3.1.401/NuGet.targets(128,5)：错误：无法加载源 https://pkgs.dev.azure.com/MYCOMPANY/_packaging/MYPROJECT/nuget/v3/index.json 的服务索引。 [/src/Project/ProjectName.csproj] /usr/share/dotnet/sdk/3.1.401/NuGet.targets(128,5)：错误：响应状态码不表示成功：401（未授权）。 [/src/Project/ProjectName.csproj] 命令 '/bin/sh -c dotnet restore -s "https://pkgs.dev.azure.com/MYCOMPANY/_packaging/MYPROJECT/nuget/v3/index.json" "Project/ProjectName.csproj"' 返回了一个非零码：1

Dockerfile

FROM mcr.microsoft.com/dotnet/core/aspnet:3.1-buster-slim AS base
WORKDIR /app
EXPOSE 80

ENV NUGET_CREDENTIALPROVIDER_SESSIONTOKENCACHE_ENABLED true
ENV VSS_NUGET_EXTERNAL_FEED_ENDPOINTS \
"{"endpointCredentials": [{"endpoint":"https://pkgs.dev.azure.com/MYCOMPANY/_packaging/MYPROJECT/nuget/v3/index.json", "username":"USER", "password":"GENERATED_PAT"}]}"


FROM mcr.microsoft.com/dotnet/core/sdk:3.1-buster AS build
WORKDIR /src

COPY ["MyAPP.Api/MyAPP.Api.csproj", "MyAPP.Api/"]
COPY ["MyAPP.DI/MyAPP.DI.csproj", "MyAPP.DI/"]
COPY ["MyAPP.Application/MyAPP.Application.csproj", "MyAPP.Application/"]
COPY ["MyAPP.Domain/MyAPP.Domain.csproj", "MyAPP.Domain/"]
COPY ["MyAPP.Infrastructure/MyAPP.Infrastructure.csproj", "MyAPP.Infrastructure/"]

RUN dotnet restore -s "https://pkgs.dev.azure.com/MYCOMPANY/_packaging/MYPROJECT/nuget/v3/index.json" "MyAPP.Domain/MyAPP.Domain.csproj"

COPY . .
WORKDIR "/MyAPP.Api"
RUN dotnet build "MyAPP.Api.csproj" -c Release -o /app/build

FROM build AS publish
RUN dotnet publish "MyAPP.Api.csproj" -c Release -o /app/publish

FROM base AS final
WORKDIR /app
COPY --from=publish /app/publish .
ENTRYPOINT ["dotnet", "MyAPP.Api.dll"]

Answer 1

问题的主要原因：

dotnet restore 命令无法实际访问您通过 ENV 设置的凭据。

您可以添加RUN printenv 来打印 ENV 变量。

FROM mcr.microsoft.com/dotnet/core/aspnet:3.1-buster-slim AS base
WORKDIR /app
EXPOSE 80

ENV NUGET_CREDENTIALPROVIDER_SESSIONTOKENCACHE_ENABLED true
ENV VSS_NUGET_EXTERNAL_FEED_ENDPOINTS \
"{"endpointCredentials": [{"endpoint":"https://pkgs.dev.azure.com/MYCOMPANY/_packaging/MYPROJECT/nuget/v3/index.json", "username":"USER", "password":"GENERATED_PAT"}]}"
RUN printenv

FROM mcr.microsoft.com/dotnet/core/sdk:3.1-buster AS build
WORKDIR /src
RUN printenv

查看第一个printenv和第二个printenv命令的日志，可以发现运行dotnet restore的环境无法访问凭证。

解决方案：

您可以在RUN dotnet restore 步骤之前移动/复制define ENV 步骤。

FROM mcr.microsoft.com/dotnet/core/sdk:3.1-buster AS build
WORKDIR /src

...

ENV NUGET_CREDENTIALPROVIDER_SESSIONTOKENCACHE_ENABLED true
ENV VSS_NUGET_EXTERNAL_FEED_ENDPOINTS \
"{"endpointCredentials": [{"endpoint":"https://pkgs.dev.azure.com/MYCOMPANY/_packaging/MYPROJECT/nuget/v3/index.json", "username":"USER", "password":"GENERATED_PAT"}]}"

RUN dotnet restore -s "https://pkgs.dev.azure.com/MYCOMPANY/_packaging/MYPROJECT/nuget/v3/index.json" "MyAPP.Domain/MyAPP.Domain.csproj"