Open thomasyu888 opened 5 years ago
Specifically there is an error that says: workflow-orchestrator_1 | com.github.dockerjava.api.exception.InternalServerErrorException: {"message":"Get https://registry-1.docker.io/v2/sagebionetworks/synapse-workflow-orchestrator-toil/manifests/1.0: unauthorized: incorrect username or password"}
@thomasyu888 can you do one of the following?
1) before running the Orchestrator, run
docker pull sagebionetworks/synapse-workflow-orchestrator-toil:1.0
or
2) add to your .env
DOCKERHUB_USERNAME=<your DockerHub name>
DOCKERHUB_PASSWORD=<your DockerHub password>
and add to docker-compose.yaml
environment:
....
- DOCKERHUB_USERNAME=${DOCKERHUB_USERNAME}
- DOCKERHUB_PASSWORD=${DOCKERHUB_PASSWORD}
The interesting part about this is that I don't need to log into dockerhub to pull public images. So there is something specific about Get https://registry-1.docker.io/v2/sagebionetworks/synapse-workflow-orchestrator-toil/manifests/1.0
that requires me to be logged into dockerhub?
Edit. Tried 1 - same error Tried 2 - same error 1 + 2 - same error
I should not have suggested (1), it won't help. That is, the Orchestrator will try to pull the image regardless of whether you already have it.
I checked the Java Docker client used by the Orchestrator and verified it will pull a public repo' when no user name or password is given. I tested several repo's including sagebionetworks/synapse-workflow-orchestrator-toil:1.0
. Also I checked that sagebionetworks/synapse-workflow-orchestrator-toil:1.0
is public. I also verified that the Orchestrator will fail to download a private image when I don't pass cred's, so it's not that it's getting cred's elsewhere.
I further verified that if I pass the wrong credentials when pulling a public repository it still works, so the Registry must know not to check credentials when pulling a public repo'.
Hm. Here is my workflow:
docker --version
Docker version 18.06.1-ce, build e68fc7a215d7133c34aa18e3b72b4a21fd0c6136
docker logout
Removing login credentials for https://index.docker.io/v1/
docker images
REPOSITORY TAG IMAGE ID CREATED SIZE
sagebionetworks/synapse-workflow-orchestrator 1.0 cc4f371498bc 4 hours ago 966MB
sagebionetworks/synapse-workflow-orchestrator-toil 1.0 85858597c42a 4 hours ago 2.01GB
sagebionetworks/synapse-workflow-orchestrator-wes 1.0 005f779dcdc7 5 hours ago 1.25GB
ubuntu latest 2ca708c1c9cc 3 weeks ago 64.2MB
docker rm $(docker ps -aq)
docker rmi $(docker images -q)
docker-compose up
I still receive the same error. I also removed DOCKERHUB_USERNAME and DOCKERHUB_PASSWORD
Here is my .env
#WES_ENPDOINT=http://localhost:8082
DOCKER_ENGINE_URL=unix:///var/run/docker.sock
#DOCKER_ENGINE_URL=
#WES_SHARED_DIR_PROPERTY=/home/tyu/orchestrator
SYNAPSE_USERNAME=xxxxx
SYNAPSE_PASSWORD=xxxxx
WORKFLOW_OUTPUT_ROOT_ENTITY_ID=syn4990358
EVALUATION_TEMPLATES={"9614111": "syn20946645"}
TOIL_CLI_OPTIONS=--defaultMemory 100M --retryCount 0 --defaultDisk 1000000
COMPOSE_PROJECT_NAME=workflow_orchestrator
#NOTIFICATION_PRINCIPAL_ID=
#SHARE_RESULTS_IMMEDIATELY=
#DATA_UNLOCK_SYNAPSE_PRINCIPAL_ID=
#WORKFLOW_ENGINE_DOCKER_IMAGE=
#MAX_CONCURRENT_WORKFLOWS=10
#RUN_WORKFLOW_CONTAINER_IN_PRIVILEGED_MODE=```
I can reproduce the problem, by running the containerized Orchestrator:
workflow-orchestrator_1 | com.github.dockerjava.api.exception.InternalServerErrorException: {"message":"Get https://registry-1.docker.io/v2/sagebionetworks/synapse-workflow-orchestrator-toil/manifests/1.0: unauthorized: incorrect username or password"}
I can verify that passing my correct DockerHub credentials does not fix the problem.
When I try to reproduce the error by running the internal Java library it works fine!
More insight: The problem goes away if you switch to the 'old' Toil image, i.e. changing from
sagebionetworks/synapse-workflow-orchestrator-toil:1.0
to
sagebionetworks/synapseworkflowhook-toil
Maybe it has something to do with defining a tag?
I had the same thought. I will test that and also will try upgrading to a newer version of the Java Docker client.
Maybe it has something to do with defining a tag?
Yes! I pushed sagebionetworks/synapse-workflow-orchestrator-toil:1.0
to DockerHub as sagebionetworks/synapse-workflow-orchestrator-toil
and used the latter with the Orchestrator. It worked, no problem.
I upgraded the Java Docker client to the latest version, but nothing changed.
I tried replacing sagebionetworks/synapse-workflow-orchestrator-toil
with sagebionetworks/synapse-workflow-orchestrator-toil:latest
which is a synonym. While the version with no tag works, the version with the 'latest' tag does not.
workflow-orchestrator_1 | com.github.dockerjava.api.exception.InternalServerErrorException: Get https://registry-1.docker.io/v2/sagebionetworks/synapse-workflow-orchestrator-toil/manifests/latest: unauthorized: incorrect username or password
What's maddening is that there is no problem when I run the Docker Java client from my IDE, everything's fine. It only breaks when running in a container. That tells me that in the 'IDE case' the library is accessing registry credentials on my machine. I broke my stored registry password, confirmed by trying to 'docker pull' from the command line. But the 'IDE case' still works.