Docker API responded with status code=Forbidden

[Neil Scales]

I've started getting this error during a C# build pipeline that tests some code:

Docker.DotNet.DockerApiException : Docker API responded with status code=Forbidden, response={"message":"authorization denied by plugin pipelines: Invalid request"}

The tests spin up a docker container to hold the mysql database that is used for integration tests.  This part is not new.

This problem started when the code was upgraded from net6 to net8, but the pipeline was already running on the net8 SDK, and previously the net6 SDK was installed as part of the build, before any testing.   Now it just build and runs the tests as net8.

The docker build logs contain this:

time="2025-01-10T14:13:48.173467253Z" level=error msg="AuthZRequest for HEAD /_ping returned error: authorization denied by plugin pipelines: "
time="2025-01-10T14:15:11Z" level=info msg="Pipelines plugin request authorization." allowed=false method=POST plugin=pipelines uri=/containers/create

[Sahir Maharaj]

Hello @Neil Scales

This issue likely stems from changes in how requests are handled in .NET 8, potentially affecting the way your pipeline interacts with Docker. Here’s what I would suggest to troubleshoot and resolve the issue:

Ensure the user running the build pipeline has adequate permissions to interact with Docker. Verify that this user is added to the docker group on the host machine, which allows non-root users to manage Docker.

The Pipelines plugin seems to be rejecting the authorization request. Check the plugin configuration to ensure it permits Docker operations for your pipeline's user. You may need to update the plugin's settings to align with the changes introduced by .NET 8.

Hope this helps.

[Carlos]

We have the same issue: updating TestContainers 4.1.0 breaks our pipeline. The problem is related to the Docker version. Do you have plans to update to version 27?

[Neil Scales]

This isn't an answer, but the smoking gun is that Testcontainers v4.0.0 works, but v4.1.0 doesn't work.

Further investigation points to a private fork of `Docker.Dotnet` called `Docker.Dotnet.Enhanced` that Testcontainers references.

https://www.nuget.org/packages/Docker.DotNet.Enhanced points to https://github.com/dotnet/Docker.DotNet/ but that isn't the source for the version released.

Looking at the code, I'm guessing that this line has been changed from HttpMethod.Get to HttpMethod.Head

https://github.com/dotnet/Docker.DotNet/blob/c0f44a7000221a7bc1ced1154939e19caeea067a/src/Docker.DotNet/Endpoints/SystemOperations.cs#L37

[Neil Scales]

@Sahir Maharaj 

The pipeline plugins and build users are controlled by Bitbucket, aren't they?  The Docker/host is a Bitbucket thing, not something I've set up.

[Ben]

Hi @Neil Scales 

We will need access to your workspace so we can view your YML config/build logs etc. I can see you're a Premium workspace user - can you please raise a ticket directly with our support team so we may assist you further?

• https://support.atlassian.com/contact/

If you have issues raising a ticket, please let me know your timezone so that I can raise one on your behalf with the team who operates in your region.

Cheers!

- Ben (Bitbucket Cloud Support)

[Valentin]

Hi,

It seems the problem is the Docker version from the BitBucket runner(https://github.com/testcontainers/Docker.DotNet/issues/10).

@Ben, do you know if there are any plan to update Docker from V25 to V27?