aws-samples / aws-samples/sagemaker-studio-image-build-cli

Any way to specify additional ECR registries to log in to?

Open
#13 6 comments 3 reactions 0 assignees View on GitHub
enhancement
Dominant language
Python
Stars
59
Forks
26
PR merge metrics
No merged PRs in 30d

Description

I'm trying to `sm-docker build` a container derived from SageMaker Scikit-Learn framework container in `ap-southeast-1`, something like the following:

```python
base_docker_uri = sagemaker.image_uris.retrieve(
sagemaker.sklearn.defaults.SKLEARN_NAME,
smsess.boto_region_name,
version="0.23-1",
instance_type="ml.m5.xlarge",
)
# 121021644041.dkr.ecr.ap-southeast-1.amazonaws.com/sagemaker-scikit-learn:0.23-1-cpu-py3
```

...so Dockerfile is `FROM 121021644041.dkr....etc`

Seems like the CLI tool spins up successfully and logs in to a load of **other** ECR registries, but not `121021644041`: Then fails on step 1 with:

```
[Container] 2021/04/20 02:54:22 Running command docker build -t $IMAGE_REPO_NAME:$IMAGE_TAG .
Sending build context to Docker daemon 7.68kB
Step 1/2 : FROM 121021644041.dkr.ecr.ap-southeast-1.amazonaws.com/sagemaker-scikit-learn:0.23-1-cpu-py3
Get https://121021644041.dkr.ecr.ap-southeast-1.amazonaws.com/v2/sagemaker-scikit-learn/manifests/0.23-1-cpu-py3: no basic auth credentials

[Container] 2021/04/20 02:54:22 Command did not exit successfully docker build -t $IMAGE_REPO_NAME:$IMAGE_TAG . exit status 1
```

I've since tested and on a SageMaker Notebook Instance I can build the same Dockerfile fine, so long as I log in to the `121021644041` ECR first.

From a cursory look at the job logs and #12, it looks like the current strategy is to have the tool `ecr login` to every AWS account on which AWS DLCs are provided?

...So would the correct fix be to add [every account Id listed here](https://docs.aws.amazon.com/sagemaker/latest/dg/pre-built-docker-containers-scikit-learn-spark.html) to support SKLearn?

I was thinking it might be preferable to also add a way for users to indicate extra required account IDs through the CLI, since:

- This list is going to start getting pretty long
- (Like in #12 and this issue) I guess there might always be some gaps introducing bugs
- In some rarer cases, I guess users might have private cross-account ECR needs too?

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.