artifact registry docker image for cml runner

I’m trying out a cml runner on GCP using Gitlab. I have a working file that starts up an instance with dvcorg/cml:latest docker image.

Now I want to change the docker image for my own that adds in some helper utilities specific to my team. I’m hosting the image on artifact registry in Google cloud and I have granted the cloud-permission-set access to the container registry.

However my job fails with the error:

ERROR: Job failed: failed to pull image "us-west3-docker.pkg.dev/<myproject>/containers/cml:latest" with specified policies [always]: Error response from daemon: Head "https://us-west3-docker.pkg.dev/v2/<myproject>/containers/cml/manifests/latest": denied: Permission "artifactregistry.repositories.downloadArtifacts" denied on resource "projects/<myproject>/locations/us-west3/repositories/containers" (or it may not exist) (manager.go:235:0s)

@dacbd confirmed he was able to reproduce and has a workaround for github.

[dacbd]

cml runner / gitlab-ci access to private GCP registries much like AWS/ECR’s docker-credentials-login-ecr

[shortcipher3]

Found my problem, I was missing the scopes on this line:

--cloud-permission-set=<my_account>@<my_project>.iam.gserviceaccount.com

The working version is:

--cloud-permission-set=<my_account>@<my_project>.iam.gserviceaccount.com,scopes=storage-rw,datastore

I thought my service account permissions would be sufficient.

Thanks for your help!