aws-samples / aws-samples/sagemaker-studio-image-build-cli
Any way to specify additional ECR registries to log in to?
- Dominant language
- Python
- Stars
- 59
- Forks
- 26
- PR merge metrics
- No merged PRs in 30d
Description
I'm trying to `sm-docker build` a container derived from SageMaker Scikit-Learn framework container in `ap-southeast-1`, something like the following:
```python
base_docker_uri = sagemaker.image_uris.retrieve(
sagemaker.sklearn.defaults.SKLEARN_NAME,
smsess.boto_region_name,
version="0.23-1",
instance_type="ml.m5.xlarge",
)
# 121021644041.dkr.ecr.ap-southeast-1.amazonaws.com/sagemaker-scikit-learn:0.23-1-cpu-py3
```
...so Dockerfile is `FROM 121021644041.dkr....etc`
Seems like the CLI tool spins up successfully and logs in to a load of **other** ECR registries, but not `121021644041`: Then fails on step 1 with:
```
[Container] 2021/04/20 02:54:22 Running command docker build -t $IMAGE_REPO_NAME:$IMAGE_TAG .
Sending build context to Docker daemon 7.68kB
Step 1/2 : FROM 121021644041.dkr.ecr.ap-southeast-1.amazonaws.com/sagemaker-scikit-learn:0.23-1-cpu-py3
Get https://121021644041.dkr.ecr.ap-southeast-1.amazonaws.com/v2/sagemaker-scikit-learn/manifests/0.23-1-cpu-py3: no basic auth credentials
[Container] 2021/04/20 02:54:22 Command did not exit successfully docker build -t $IMAGE_REPO_NAME:$IMAGE_TAG . exit status 1
```
I've since tested and on a SageMaker Notebook Instance I can build the same Dockerfile fine, so long as I log in to the `121021644041` ECR first.
From a cursory look at the job logs and #12, it looks like the current strategy is to have the tool `ecr login` to every AWS account on which AWS DLCs are provided?
...So would the correct fix be to add [every account Id listed here](https://docs.aws.amazon.com/sagemaker/latest/dg/pre-built-docker-containers-scikit-learn-spark.html) to support SKLearn?
I was thinking it might be preferable to also add a way for users to indicate extra required account IDs through the CLI, since:
- This list is going to start getting pretty long
- (Like in #12 and this issue) I guess there might always be some gaps introducing bugs
- In some rarer cases, I guess users might have private cross-account ECR needs too?
Contributor guide
Assessment
This issue has not been assessed yet.