# No basic auth credentials, yet using ECR plugin **URL:** \ **Category:** General\ **Created:** [December 10, 2018, 2:12pm UTC](https://forum.buildkite.community/t/no-basic-auth-credentials-yet-using-ecr-plugin/149 "2018-12-10T14:12:39Z")\ **Posts on this page:** 13\ **Page:** 1
**Author:** ![nathan.pierce](https://sea2.discourse-cdn.com/flex016/user_avatar/forum.buildkite.community/nathan.pierce/32/393_2.png) [@nathan.pierce](https://forum.buildkite.community/u/nathan.pierce)\ **Post date:** [December 10, 2018, 2:12pm UTC](https://forum.buildkite.community/t/no-basic-auth-credentials-yet-using-ecr-plugin/149/1 "2018-12-10T14:12:40Z")
``` plugins: ecr#v1.1.4: login: true account_ids: "436617320022" no-include-email: true docker#v2.0.0: image: "436617320022.dkr.ecr.us-west-2.amazonaws.com/ci:centos" workdir: /data/job timeout: 120 ``` > Running plugin [GitHub - buildkite-plugins/ecr-buildkite-plugin: 🔐 Login to an AWS ECR registry](http://github.com/buildkite-plugins/ecr-buildkite-plugin#v1.1.4) pre-command hook 0s > Authenticating with AWS ECR to 436617320022 5s > WARNING! Using --password via the CLI is insecure. Use --password-stdin. > Login Succeeded > # AWS\_DEFAULT\_REGION changed > Running plugin [GitHub - buildkite-plugins/docker-buildkite-plugin: 🐳📦 Run any build step in a Docker container](http://github.com/buildkite-plugins/docker-buildkite-plugin#v2.0.0) command hook 0s > docker Running /bin/sh -e -c 'echo “+++ 🔨 Building” && \ 1s > echo 1 ./build.sh && > echo “— Compressing build directory 🗜” && > tar -pczf build.tar.gz build/ > ’ in [436617320022.dkr.ecr.us-west-2.amazonaws.com/ci:centos](http://436617320022.dkr.ecr.us-west-2.amazonaws.com/ci:centos) > Unable to find image ‘[436617320022.dkr.ecr.us-west-2.amazonaws.com/ci:centos](http://436617320022.dkr.ecr.us-west-2.amazonaws.com/ci:centos)’ locally > docker: Error response from daemon: Get [https://436617320022.dkr.ecr.us-west-2.amazonaws.com/v2/ci/manifests/centos:](https://436617320022.dkr.ecr.us-west-2.amazonaws.com/v2/ci/manifests/centos:) no basic auth credentials. > See ‘docker run --help’. > 🚨 Error: The command exited with status 125 I’m curious if someone knows why a successful login with the ECR plugin still causes the docker command to fail? ---
**Author:** ![nathan.pierce](https://sea2.discourse-cdn.com/flex016/user_avatar/forum.buildkite.community/nathan.pierce/32/393_2.png) [@nathan.pierce](https://forum.buildkite.community/u/nathan.pierce)\ **Post date:** [December 10, 2018, 2:50pm UTC](https://forum.buildkite.community/t/no-basic-auth-credentials-yet-using-ecr-plugin/149/2 "2018-12-10T14:50:56Z")
Tried 2.1.0, still no difference. > Running plugin [GitHub - buildkite-plugins/docker-buildkite-plugin: 🐳📦 Run any build step in a Docker container](http://github.com/buildkite-plugins/docker-buildkite-plugin#v2.1.0) command hook 0s > $ /var/lib/buildkite-agent/plugins/github-com-buildkite-plugins-docker-buildkite-plugin-v2-1-0/hooks/command > 🔨 Enabling debug mode 0s > docker Running /bin/sh -e -c 'echo “+++ 🔨 Building” && \ 1s > echo 1 ./build.sh && > echo “— Compressing build directory 🗜” && > tar -pczf build.tar.gz build/ > ’ in [436617320022.dkr.ecr.us-west-2.amazonaws.com/ci:centos](http://436617320022.dkr.ecr.us-west-2.amazonaws.com/ci:centos) > $ docker run -it --rm --volume /var/lib/buildkite-agent/builds/automation-builder-fleet/EOSIO/eosio-dot-cdt-dot-testing:/data/job --workdir /data/job --env BUILDKITE\_JOB\_ID --env BUILDKITE\_BUILD\_ID --env BUILDKITE\_AGENT\_ACCESS\_TOKEN --volume /usr/bin/buildkite-agent:/usr/bin/buildkite-agent [436617320022.dkr.ecr.us-west-2.amazonaws.com/ci:centos](http://436617320022.dkr.ecr.us-west-2.amazonaws.com/ci:centos) /bin/sh -e -c echo “+++ 🔨 Building” && > echo 1 ./build.sh && > echo “— Compressing build directory 🗜” && > tar -pczf build.tar.gz build/ > Unable to find image ‘[436617320022.dkr.ecr.us-west-2.amazonaws.com/ci:centos](http://436617320022.dkr.ecr.us-west-2.amazonaws.com/ci:centos)’ locally > docker: Error response from daemon: Get [https://436617320022.dkr.ecr.us-west-2.amazonaws.com/v2/ci/manifests/centos:](https://436617320022.dkr.ecr.us-west-2.amazonaws.com/v2/ci/manifests/centos:) no basic auth credentials. > See ‘docker run --help’. > 🚨 Error: The command exited with status 1 ---
**Author:** ![anon18197598](https://avatars.discourse-cdn.com/v4/letter/a/9d8465/32.png) [@anon18197598](https://forum.buildkite.community/u/anon18197598)\ **Post date:** [December 11, 2018, 3:01am UTC](https://forum.buildkite.community/t/no-basic-auth-credentials-yet-using-ecr-plugin/149/3 "2018-12-11T03:01:12Z")
That’s a tricky one! There can be a few causes. Let’s see if we can narrow it down! First up, when you have plugins that depend on ordering, it’s a good idea to use a list for plugins vs a map. It’s rare, but there can be ordering issues with maps as yaml doesn’t guarantee enumeration order. Beyond that, the other possibility is that the ECR login is happening in a region other than `us-west-2`, which would explain the issue. Do you know what region your agent instance is in? Perhaps you could try: ```auto plugins: - ecr#v1.1.4: login: true account_ids: "436617320022" no-include-email: true region: us-west-2 - docker#v2.0.0: image: "436617320022.dkr.ecr.us-west-2.amazonaws.com/ci:centos" workdir: /data/job timeout: 120 ``` ---
**Author:** ![nathan.pierce](https://sea2.discourse-cdn.com/flex016/user_avatar/forum.buildkite.community/nathan.pierce/32/393_2.png) [@nathan.pierce](https://forum.buildkite.community/u/nathan.pierce)\ **Post date:** [December 11, 2018, 8:27pm UTC](https://forum.buildkite.community/t/no-basic-auth-credentials-yet-using-ecr-plugin/149/4 "2018-12-11T20:27:14Z")
Turns out it was the region that was the issue. However, the - before the plugins seems to have broken it, throwing:`Error: Failed to parse plugin definition: Configuration for "github.com/buildkite-plugins/login-buildkite-plugin" is not a hash` All set, thanks for the help! ---
**Author:** ![anon18197598](https://avatars.discourse-cdn.com/v4/letter/a/9d8465/32.png) [@anon18197598](https://forum.buildkite.community/u/anon18197598)\ **Post date:** [December 11, 2018, 10:58pm UTC](https://forum.buildkite.community/t/no-basic-auth-credentials-yet-using-ecr-plugin/149/5 "2018-12-11T22:58:32Z")
That’s odd, I wonder if perhaps the indenting didn’t come through correctly? The dashes are very important for ordering, otherwise you might login after your docker command! ---
**Author:** ![nathan.pierce](https://sea2.discourse-cdn.com/flex016/user_avatar/forum.buildkite.community/nathan.pierce/32/393_2.png) [@nathan.pierce](https://forum.buildkite.community/u/nathan.pierce)\ **Post date:** [December 12, 2018, 1:59pm UTC](https://forum.buildkite.community/t/no-basic-auth-credentials-yet-using-ecr-plugin/149/6 "2018-12-12T13:59:26Z")
I’m seeing 100% of runs so far order things properly, without dashes. I’ll keep an eye out on the runs and look for it mixing them up. ---
**Author:** ![anon18197598](https://avatars.discourse-cdn.com/v4/letter/a/9d8465/32.png) [@anon18197598](https://forum.buildkite.community/u/anon18197598)\ **Post date:** [December 14, 2018, 5:32am UTC](https://forum.buildkite.community/t/no-basic-auth-credentials-yet-using-ecr-plugin/149/7 "2018-12-14T05:32:46Z")
Yup, it’s deterministically unordered! Up to you, but I promise it’s a convention that will eventually lead to very confusing ordering issues. ---
**Author:** ![nathan.pierce](https://sea2.discourse-cdn.com/flex016/user_avatar/forum.buildkite.community/nathan.pierce/32/393_2.png) [@nathan.pierce](https://forum.buildkite.community/u/nathan.pierce)\ **Post date:** [January 2, 2019, 10:49pm UTC](https://forum.buildkite.community/t/no-basic-auth-credentials-yet-using-ecr-plugin/149/8 "2019-01-02T22:49:13Z")
Hey Lox, wanted to follow up on this. So far all of the pipelines are choosing the proper order for plugins using: ``` plugins: ecr#v1.1.4: login: true account_ids: "123" no-include-email: true region: "us-west-2" docker#v2.1.0: debug: false image: "123.dkr.ecr.us-west-2.amazonaws.com/ci:centos7" workdir: /data/job ``` Is this a problem with the version of buildkite we’re using? We’re using v3.7.0. Wonder if you have any ideas why I can’t use a list ( - before docker and ecr lines) without it failing. Thanks! ---
**Author:** ![anon18197598](https://avatars.discourse-cdn.com/v4/letter/a/9d8465/32.png) [@anon18197598](https://forum.buildkite.community/u/anon18197598)\ **Post date:** [January 2, 2019, 11:02pm UTC](https://forum.buildkite.community/t/no-basic-auth-credentials-yet-using-ecr-plugin/149/9 "2019-01-02T23:02:25Z")
When I use this pipeline yaml: ```auto steps: - label: "test" command: echo hello world plugins: - ecr#v1.1.4: login: true account_ids: "123" no-include-email: true region: "us-west-2" - docker#v2.1.0: debug: false image: "123.dkr.ecr.us-west-2.amazonaws.com/ci:centos7" workdir: /data/job ``` And run it with `buildkite-agent pipeline upload --dry-run test.yml`, I get the following parse output: ```json { "steps": [ { "label": "test", "command": "echo hello world", "plugins": [ { "ecr#v1.1.4": { "login": true, "account_ids": "123", "no-include-email": true, "region": "us-west-2" } }, { "docker#v2.1.0": { "debug": false, "image": "123.dkr.ecr.us-west-2.amazonaws.com/ci:centos7", "workdir": "/data/job" } } ] } ] } ``` That all looks right to me! Are you able to replicate those results? ---
**Author:** ![nathan.pierce](https://sea2.discourse-cdn.com/flex016/user_avatar/forum.buildkite.community/nathan.pierce/32/393_2.png) [@nathan.pierce](https://forum.buildkite.community/u/nathan.pierce)\ **Post date:** [January 7, 2019, 5:00pm UTC](https://forum.buildkite.community/t/no-basic-auth-credentials-yet-using-ecr-plugin/149/10 "2019-01-07T17:00:21Z")
buildkite-agent version 3.7.0, build 2659 Odd, I still can’t get the plugins in a yaml list to work. I originally thought it might be that I’ve got `- command:` and no label. But adding a `- label: “test” and then command on the next line doesn’t change it. ---
**Author:** ![anon18197598](https://avatars.discourse-cdn.com/v4/letter/a/9d8465/32.png) [@anon18197598](https://forum.buildkite.community/u/anon18197598)\ **Post date:** [January 9, 2019, 5:10am UTC](https://forum.buildkite.community/t/no-basic-auth-credentials-yet-using-ecr-plugin/149/11 "2019-01-09T05:10:46Z")
Are you able to post the output from `buildkite-agent pipeline upload --dry-run` @nathan.pierce? ---
**Author:** ![nathan.pierce](https://sea2.discourse-cdn.com/flex016/user_avatar/forum.buildkite.community/nathan.pierce/32/393_2.png) [@nathan.pierce](https://forum.buildkite.community/u/nathan.pierce)\ **Post date:** [January 29, 2019, 2:44pm UTC](https://forum.buildkite.community/t/no-basic-auth-credentials-yet-using-ecr-plugin/149/12 "2019-01-29T14:44:14Z")
> [@anon18197598](#): > > - label: “test” command: echo hello world plugins: - ecr#v1.1.4: login: true account\_ids: “123” no-include-email: true region: “us-west-2” - docker#v2.1.0: debug: false image: “[123.dkr.ecr.us-west-2.amazonaws.com/ci:centos7](http://123.dkr.ecr.us-west-2.amazonaws.com/ci:centos7)” workdir: /data/job Hmm, here is the output of your test and mine in a dry-run: ``` { "steps": [ { "label": "test", "command": "echo hello world", "plugins": [ { "ecr#v1.1.4": { "login": true, "account_ids": "123", "no-include-email": true, "region": "us-west-2" } }, { "docker#v2.1.0": { "debug": false, "image": "123.dkr.ecr.us-west-2.amazonaws.com/ci:centos7", "workdir": "/data/job" } } ] }, { "command": "echo \"+++ :hammer: Building\" \u0026\u0026 \\\necho 1 | ./eosio_build.sh \u0026\u0026 \\\necho \"--- :compression: Compressing build directory\" \u0026\u0026 \\\ntar -pczf build.tar.gz build/\n", "label": ":centos: 7 Build", "agents": { "queue": "automation-large-builder-fleet" }, "artifact_paths": "build.tar.gz", "plugins": { "ecr#v1.1.4": { "login": true, "account_ids": "123", "no-include-email": true, "region": "us-west-2" }, "docker#v2.1.0": { "debug": true, "image": "123.dkr.ecr.us-west-2.amazonaws.com/ci:centos7", "workdir": "/data/job" } }, "timeout": 60 } ] } ``` I’m going to keep playing around with this… One thing I notice is that “plugins” is not an array like yours is. That could be the reason I’m not getting a mix up of the plugin order. ---
**Author:** ![anon18197598](https://avatars.discourse-cdn.com/v4/letter/a/9d8465/32.png) [@anon18197598](https://forum.buildkite.community/u/anon18197598)\ **Post date:** [January 29, 2019, 11:29pm UTC](https://forum.buildkite.community/t/no-basic-auth-credentials-yet-using-ecr-plugin/149/13 "2019-01-29T23:29:18Z")
Yup, that is a difference! See my quote from earlier: > [@anon18197598](#): > > Yup, it’s deterministically unordered! Up to you, but I promise it’s a convention that will eventually lead to very confusing ordering issues.