I have a project from which I want to copy few container images to another project using a node application. I use container-image-builder module for the same. The copying works with service account credentials,but I want to use user account credentials. The Oauth credentials allow only copying of images within the project but not across multiple projects as OAuth credentials restricts to a single project per application. Is there any other solution so that I can use the user account? Tried the following:



async function imageCopy(){
  var imgName = 'us.gcr.io/myProj/hello-world';
  var trgtImg = 'us.gcr.io/targetProj/hello-world';
  var _clientOptions = {
    clientId: "xxxx.apps.googleusercontent.com",
    clientSecret: "yyyy",
    redirectUri: "https://domain/XYZ"
  var auth =  imgBuilder.auth(imgName,"push,pull",{
        clientOptions: _clientOptions      
  auth.then(async function(credentials){   
    const image = new imgBuilder.Image(imgName,trgtImg,credentials);
    const result = await image.save(['dev-latest']);    


and also extracted the token and sent the same

 var auth = new google.auth.OAuth2(

 function initialize(appRouter, serviceListener)
    appRouter.get('/XYZ', proceed );

    listener = serviceListener;

function renderLoginPage(req, res){
          title: "xxxx",
          login_btn_description: "Login with Google",
          login_link: generateGoogleURL()

function generateGoogleURL(){
     return auth.generateAuthUrl({
          access_type: 'offline',
          prompt: 'consent',
          scope: appScope

function proceed(req,res){
  const qs = new url.URL(req.url,config.devhostname);
  const code = qs.searchParams.get('code');  


async function getGoogleAccountFromCode(code) {
        const data = await auth.getToken(code);
        tokens = data.tokens;

async function imageCopy(){
  var imgName = 'gcr.io/myProj/hello-world';
  var trgtImg = 'gcr.io/trgtProj/hello-world';
  const image = new authParam.Image(imgName,trgtImg,{'gcr.io':{
      clientOptions: tokens
    const result = await image.save(['dev-latest']);       

Oauth credentials is restricted for single project , so what credentials of user-account should I use?

  • You want to copy some container images from one project to another. You are able to do so using a service account but you want to do the same thing using an "user" account. Correct? Have you tried adding the same role that the service account has to the user account? (when copying from one project to another, the identity credentials need to have, at least, read permissions in one project and write permissions in the other, but depending on the resource it could need other permissions as well. ). Also, which error are you encountering when using the user account? – Mayeru Jul 30 '19 at 8:07
  • Your are right. I had given the owner permission to the user account and had given the appropriate scopes during the OAuth flow. I understand that OAuth flow is restricted to a specific project and hence I receive the 403 Forbidden error while uploading the image layers at github.com/google/nodejs-container-image-builder/blob/… – amv Jul 31 '19 at 7:34
  • I know it is possible to use user account that has appropriate permissions to copy images to multiple projects using docker commands in shell script or gcloud. But my question is , is this possible using node js APIs for user accounts? – amv Jul 31 '19 at 7:34
  • To clarify, you have already successfully done this using user accounts through gcloud commands? if so, then the issue would not be the permissions itself but may be a misconfiguration when you are setting up the "container-image-builder" authentication to the Google Container Registery. -> github.com/google/nodejs-container-image-builder/tree/… – Mayeru Jul 31 '19 at 11:18
  • I install gcloud sdk, authenticate using the user account and also configure docker. Then run the script with docker commands. The images are successfully copied. I have also gone through the link that you have mentioned, but other than OAuthCredentials, I do not see which option I have to pass to copy images to different project using the same user account credentials.I did use service account and it works,but I want to know if this is possible with user account.I believe if we can do this with docker commands,then we must be able to do this using APIs. But I do not know which option to use. – amv Aug 1 '19 at 6:27

As you may see in the Google Authentication Overview it's highly recommended to use the service account instead of a user account in your app, also at some situations the user accounts are not allowed as authenticating method, this could be why you can not use the user account.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.