Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
This article discusses how to resolve a deployment failure on Microsoft Azure Container Instances that generates an "InaccessibleImage" error code.
Symptoms
When you try to deploy a container instance, the deployment fails, and you receive an error message that resembles the following text:
{
"code":"DeploymentFailed",
"message":"At least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/DeployOperations for usage details.",
"details":[{
"code":"InaccessibleImage",
"message":"The image '<container-registry-name>.azurecr.io/<image-name>:<version-name>' in container group '<container-group-name>' is not accessible. Please check the image and registry credential."}
]
}
Cause
- You're trying to use a service principal to access the Azure Container Registry.
- You specified incorrect credentials when you tried to create the container instance.
- You specified the correct credentials, but the Azure Container Registry firewall blocks the calls.
Solution
You must use a managed identity to allow the Container Instances trusted service to access the container registry. For more information, see Allow trusted services to securely access a network-restricted container registry. You can also learn more at Deploy to Azure Container Instances from Azure Container Registry using a managed identity.
Note
Image pull phase happens before container is created. If you're deploying to a Virtual Network (BYOVNET), image pull occurs through a random platform public IP. Because of this, private registries other than Azure Container Registry aren't supported even if there's private connectivity from the target subnet.