Unable to deploy specific image to App Service from Azure Container Registry

Question

I have a Linux App Service deployed within Azure, using an image from a private Azure Container Registry.

The service was up and running fine, and despite there being no changes to the image (no new pushes), the App Service was redeployed. I understand this to be an expected part of how Azure handles containers, swapping instances in and out with as it sees fit.

However, this image is no longer able to deploy successfully, here are the logs from Kudu (names changed):

2018-04-09 07:28:11.817 INFO  - Starting container for site 
2018-04-09 07:28:11.818 INFO  - docker run -d -p 36165:8080 --name my-service_0 -e WEBSITES_ENABLE_APP_SERVICE_STORAGE=false -e WEBSITES_PORT=8080 -e WEBSITE_SITE_NAME=my-service -e WEBSITE_AUTH_ENABLED=False -e WEBSITE_ROLE_INSTANCE_ID=0 -e WEBSITE_INSTANCE_ID=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX -e HTTP_LOGGING_ENABLED=1 myacr.azurecr.io/images/my-image:latest  

2018-04-09 07:28:14.200 INFO  - Issuing docker pull myacr.azurecr.io/images/my-image:latest 
2018-04-09 07:28:14.327 ERROR - docker pull returned STDERR>> Error response from daemon: Get https://myacr.azurecr.io/v2/images/my-image/manifests/latest: unauthorized: authentication required

Here are the results of pulling the image locally:

docker pull myacr.azurecr.io/images/my-image:latest
latest: Pulling from images/my-image 
53478ce18e19: Already exists 
d1c225ed7c34: Already exists 
c6724ba0c09a: Already exists 
377ae380bb14: Pulling fs layer 
ab6e212b3598: Pulling fs layer 
377ae380bb14: Downloading 
ab6e212b3598: Verifying Checksum 
ab6e212b3598: Download complete
unknown blob

I'm fairly sure that the image was successfully deployed 3 days ago and that there has been no pushes to the tag since then.

Is there anything I can do to recover this image?

Is there any way I could have known this deployment had started failing?

Answer 1

It seems your Web App for Containers instance is unable to authenticate with Azure Container Registry.

The Azure Container Registry to Linux Web App connection is a bit problematic at times. Using the "private registry" tab on the container settings page instead of ACR usually solves the problem for me.

Just provide your ACR repo credentials as below instead of selecting your repo on the ACR tab.