构建docker映像时无法在Azure DevOps（工件）中进行授权

Question

我在Azure DevOps中有工件，并尝试创建docker构建。

• 平台：Microsoft .NET Core 3.1
• Docker（本地）：19.03.12

我执行的步骤：

1. 在Azure DevOps中创建PAT（具有完全权限）
2. 使用Visual Studio 2019生成Dockerfile
3. 将其添加到Dockerfile中：

ENV VSS_NUGET_EXTERNAL_FEED_ENDPOINTS
“ {” endpointCredentials“：[{” endpoint“：” https://pkgs.dev.azure.com/MYCOMPANY/_packaging/MYPROJECT/nuget/v3/index.json“，”用户名“：” USER“，”密码“：” GENERATED_PAT“}]}”

1. 添加COPY命令后：

运行dotnet还原-s“ https：// https：//pkgs.dev.azure.com/MYCOMPANY/_packaging/MYPROJECT/nuget/v3/index.json”“ Project / ProjectName.csproj”

但是我在运行时收到“未经授权”错误：docker build。 -t mydockerfile：v1

/usr/share/dotnet/sdk/3.1.401/NuGet.targets（128,5）：错误：无法为源https://pkgs.dev.azure.com/MYCOMPANY/_packaging/MYPROJECT/nuget/v3/index.json加载服务索引。 [/src/Project/ProjectName.csproj] /usr/share/dotnet/sdk/3.1.401/NuGet.targets(128,5）：错误：响应状态代码未指示成功：401（未授权）。 [/src/Project/ProjectName.csproj] 命令'/ bin / sh -c dotnet restore -s“ https://pkgs.dev.azure.com/MYCOMPANY/_packaging/MYPROJECT/nuget/v3/index.json”“ Project / ProjectName.csproj”返回了非零代码：1

Dockerfile

FROM mcr.microsoft.com/dotnet/core/aspnet:3.1-buster-slim AS base
WORKDIR /app
EXPOSE 80

ENV NUGET_CREDENTIALPROVIDER_SESSIONTOKENCACHE_ENABLED true
ENV VSS_NUGET_EXTERNAL_FEED_ENDPOINTS \
"{"endpointCredentials": [{"endpoint":"https://pkgs.dev.azure.com/MYCOMPANY/_packaging/MYPROJECT/nuget/v3/index.json", "username":"USER", "password":"GENERATED_PAT"}]}"


FROM mcr.microsoft.com/dotnet/core/sdk:3.1-buster AS build
WORKDIR /src

COPY ["MyAPP.Api/MyAPP.Api.csproj", "MyAPP.Api/"]
COPY ["MyAPP.DI/MyAPP.DI.csproj", "MyAPP.DI/"]
COPY ["MyAPP.Application/MyAPP.Application.csproj", "MyAPP.Application/"]
COPY ["MyAPP.Domain/MyAPP.Domain.csproj", "MyAPP.Domain/"]
COPY ["MyAPP.Infrastructure/MyAPP.Infrastructure.csproj", "MyAPP.Infrastructure/"]

RUN dotnet restore -s "https://pkgs.dev.azure.com/MYCOMPANY/_packaging/MYPROJECT/nuget/v3/index.json" "MyAPP.Domain/MyAPP.Domain.csproj"

COPY . .
WORKDIR "/MyAPP.Api"
RUN dotnet build "MyAPP.Api.csproj" -c Release -o /app/build

FROM build AS publish
RUN dotnet publish "MyAPP.Api.csproj" -c Release -o /app/publish

FROM base AS final
WORKDIR /app
COPY --from=publish /app/publish .
ENTRYPOINT ["dotnet", "MyAPP.Api.dll"]

Answer 1

问题的主要原因：

dotnet restore命令不能实际访问您通过ENV设置的凭据。

您可以添加RUN printenv以打印ENV变量。

FROM mcr.microsoft.com/dotnet/core/aspnet:3.1-buster-slim AS base
WORKDIR /app
EXPOSE 80

ENV NUGET_CREDENTIALPROVIDER_SESSIONTOKENCACHE_ENABLED true
ENV VSS_NUGET_EXTERNAL_FEED_ENDPOINTS \
"{"endpointCredentials": [{"endpoint":"https://pkgs.dev.azure.com/MYCOMPANY/_packaging/MYPROJECT/nuget/v3/index.json", "username":"USER", "password":"GENERATED_PAT"}]}"
RUN printenv

FROM mcr.microsoft.com/dotnet/core/sdk:3.1-buster AS build
WORKDIR /src
RUN printenv

检查第一个printenv和第二个printenv命令的日志，您会发现运行dotnet restore的环境无法访问凭据。

解决方案：

您可以在define ENV步骤之前移动/复制RUN dotnet restore步骤。

FROM mcr.microsoft.com/dotnet/core/sdk:3.1-buster AS build
WORKDIR /src

...

ENV NUGET_CREDENTIALPROVIDER_SESSIONTOKENCACHE_ENABLED true
ENV VSS_NUGET_EXTERNAL_FEED_ENDPOINTS \
"{"endpointCredentials": [{"endpoint":"https://pkgs.dev.azure.com/MYCOMPANY/_packaging/MYPROJECT/nuget/v3/index.json", "username":"USER", "password":"GENERATED_PAT"}]}"

RUN dotnet restore -s "https://pkgs.dev.azure.com/MYCOMPANY/_packaging/MYPROJECT/nuget/v3/index.json" "MyAPP.Domain/MyAPP.Domain.csproj"