Examkin

Soru

Zorluk: OrtaManage Container Images in Azure Container Registry

You are configuring a continuous integration pipeline in GitHub Actions to build and push a container image to an Azure Container Registry (ACR) named contosoacr.azurecr.io. The runner does not have the Azure CLI installed, but has the Docker CLI installed. You have created an Azure Active Directory (Azure AD) service principal with the AcrPush role.

You need to authenticate the Docker CLI on the runner to contosoacr.azurecr.io using the service principal credentials.

Which command should you execute in the pipeline runner?

  1. A
    az acr login --name contosoacr --username <clientId> --password <clientSecret>
  2. B
    echo <clientSecret> | docker login contosoacr --username <clientId> --password-stdin
  3. echo <clientSecret> | docker login contosoacr.azurecr.io --username <clientId> --password-stdinCevap
  4. D
    Configure a system-assigned managed identity for the GitHub-hosted runner, and run az acr login --name contosoacr without credentials.

Cevap

Run the command: echo <clientSecret> | docker login contosoacr.azurecr.io --username <clientId> --password-stdin
To authenticate the Docker CLI with an Azure Container Registry using a service principal when the Azure CLI is unavailable, you must use the standard docker login command. The username must be the service principal's Client ID, the password must be the Client Secret, and the target registry must be specified by its repository login server domain name.

Adım Adım Çözüm

1
Identify the target registry URL and the authentication tools available.
The target registry is contosoacr.azurecr.io, and only the Docker CLI is available on the runner.
The runner does not have Azure CLI installed, meaning az acr commands cannot be executed.
2
Formulate the Docker login command using the service principal credentials.
Use the client ID as the username and the client secret as the password targeting contosoacr.azurecr.io.
The Docker CLI requires the full login server domain to route the authentication request to Azure Container Registry rather than Docker Hub.
3
Securely pass the client secret to the Docker login command.
Pipe the client secret into docker login using the --password-stdin flag.
Passing passwords directly via command line arguments is insecure and can expose credentials in build logs.

Anahtar Kavram

Authenticating to Azure Container Registry using Docker CLI and service principal credentials.
Bu soruyu puanla

Konular

Manage Container Images in Azure Container Registry

Bu konudan daha fazla soru