Docker login to AWS ECR fails with "dial tcp xxxx:443: i/o timeout"

Question

I'm stepping through a "Scaling Docker for AWS" course which specifies using "aws ecr get-login" to get a "docker login" command line.

I'm running docker version 1.12.6.

When I run the output command line, which specifies an "AWS" user and a long password and and an https url in the "amazonaws.com" domain, I get something like the following:

Error response from daemon: Get https://....amazonaws.com/v1/users/: dial tcp xx.xx.xx.xx:443: i/o timeout

I then tried to curl directly to the fqhn, and it connected, but returned a 401 (unsurprisingly, as I didn't send any credentials on the curl call).

I also used nslookup to verify that the fqhn resolves to the IP address specified in the error message (and two other IP addresses).

Note that right now I'm running this behind a corp firewall. In "/etc/systemd/system/docker.service.d" I have a "http-proxy.conf" file that I believe is correctly setting the HTTP_PROXY and HTTPS_PROXY env vars.

I also tried disconnecting from the corp network, unsetting the two var settings in that file, reloading the daemon, restarting the docker service, and rerunning the command line. I got the exact same error.

What else can I do to diagnose this?

Update:

Because I couldn't think of anything else to try, I upgraded from 1.12.6 to 18.03.0-ce. The results are the same. I specified our proxy host:port in the config.json as described in the docs. I removed that setting when I attempted the connection not using our proxy (wifi hotspot on my phone).

Answer 1

Did you reload systemd?

systemctl daemon-reload

You should be able to test once reloaded if your file is correct

systemctl show --property Environment docker

If so a docker restart should be working via proxy

Answer 2

I finally figured this out. What I didn't mention in this note is that I'm doing this in a VirtualBox VM.

The only way this can work at all is if I connect without the corp firewall, using the hotspot on my phone. What I didn't realize is that when I connect with that, I also have to change the networking connection on the VM. Within the corp firewall, it has to be NAT, but when I'm not in the corp network, it has to be bridged. Once I unset my proxy env vars, I was able to generate and successfully complete the aws ecr docker login command.