Problem with Aspirate dotnet publish pushing containers to registry — unclear where credentials are taken from

[axies20]

I’m using Aspirate to generate config and deploy my .NET Aspire solution, but I can’t push my containers to the registry because of a credentials issue.
Steps I take:

1. Run aspirate init:

   • Set registry: registry.digitalocean.com
   • Set repository prefix: project-data-repository
   • Set fallback tag: latest → .aspirate.json is created successfully

2. Run aspirate build

   • Manifest is generated
   • It starts building projects and calls dotnet publish -t:PublishContainer ...

Error occurs when pushing the image:

error CONTAINER1016: Unable to access the repository 'project-data-repository/courses' in the registry 'registry.digitalocean.com'. Please confirm your credentials are correct and that you have access to this repository and registry.

I don’t understand where Aspirate (or the underlying dotnet publish) is supposed to take registry credentials from.

• I already did docker login registry.digitalocean.com (works fine, docker push succeeds).
• I also tried authenticating with doctl registry login, also works.
• But Aspirate still fails with CONTAINER1016.

Questions:

1. From where does Aspirate / dotnet publish -t:PublishContainer actually get credentials for pushing images?
2. Does Aspirate require me to pass ContainerRegistryUsername / ContainerRegistryPassword explicitly in csproj or in aspirate.json?
3. Or should it reuse my Docker credential store (like docker login)?

[engineering87]

Hello @max2020204,

1. From where does Aspirate / dotnet publish -t:PublishContainer actually get credentials for pushing images?
   From the .NET SDK container tooling. It reads Docker’s auth config at ~/.docker/config.json and uses any installed Docker credential helpers. In other words, it reuses your Docker credential store created by docker login.

2. Does Aspirate require me to pass ContainerRegistryUsername / ContainerRegistryPassword explicitly in csproj or in aspirate.json?
   No, you normally don’t put registry creds there. If Docker creds aren’t picked up, you can override via env vars:

• DOTNET_CONTAINER_REGISTRY_UNAME
• DOTNET_CONTAINER_REGISTRY_PWORD

Make sure your properties are split correctly:

dotnet publish -t:PublishContainer \
  -p:ContainerRegistry=registry.digitalocean.com \
  -p:ContainerRepository=project-data-repository/courses

and that ~/.docker/config.json has a valid entry for registry.digitalocean.com

[axies20]

Thanks for clarifying how creds are picked up. I still can’t get aspirate build / dotnet publish -t:PublishContainer to push images though, even though:

~/.docker/config.json has a valid entry for registry.digitalocean.com (I can docker push manually without issues).

I also tried setting DOTNET_CONTAINER_REGISTRY_UNAME and DOTNET_CONTAINER_REGISTRY_PWORD explicitly. Using my DigitalOcean token as password and my account email as username doesn’t work.

When I set both username and password to the token (which is how DOCR actually expects login), it still fails with CONTAINER1016.

I double-checked that the repo name is lowercase (project-data-repository/courses).

So the same credentials that work with docker push are not being picked up by dotnet publish.
Is there any known issue with the .NET container tooling on Windows not reading config.json correctly, or some extra flag/env var needed to point it to the right Docker config?

[engineering87]

Thanks for clarifying how creds are picked up. I still can’t get aspirate build / dotnet publish -t:PublishContainer to push images though, even though:

~/.docker/config.json has a valid entry for registry.digitalocean.com (I can docker push manually without issues).

I also tried setting DOTNET_CONTAINER_REGISTRY_UNAME and DOTNET_CONTAINER_REGISTRY_PWORD explicitly. Using my DigitalOcean token as password and my account email as username doesn’t work.

When I set both username and password to the token (which is how DOCR actually expects login), it still fails with CONTAINER1016.

I double-checked that the repo name is lowercase (project-data-repository/courses).

So the same credentials that work with docker push are not being picked up by dotnet publish. Is there any known issue with the .NET container tooling on Windows not reading config.json correctly, or some extra flag/env var needed to point it to the right Docker config?

Aspire build uses .NET’s container tooling, which reads creds from Docker’s config.json or the path in DOCKER_CONFIG. On Windows, pushes fail with CONTAINER1016 probrably if the required credential helper isn’t on PATH, even if docker push works.
Ensure the helper is installed, set DOCKER_CONFIG explicitly, or try to bypass Docker auth to test:

DOTNET_CONTAINER_REGISTRY_UNAME=<token>
DOTNET_CONTAINER_REGISTRY_PWORD=<token>

I don't think you need some kind of Aspire flag, it’s probrably a Docker auth issue in dotnet publish.

[axies20]

Thanks for the reply. I’ve tried the things you mentioned but I’m still stuck with CONTAINER1016.
Here’s what I did:
Set DOCKER_CONFIG to a fresh folder and ran docker login registry.digitalocean.com there (used the token for both username and password). That config works fine — I can docker push from the same shell without problems.
Avoided using any cred helpers at all (since doctl registry login can’t overwrite my ~/.docker/config.json on Windows — it errors with Access is denied). The new config.json has a plain "auths" entry.
Also tried setting both DOTNET_CONTAINER_REGISTRY_UNAME and DOTNET_CONTAINER_REGISTRY_PWORD to the token directly, just to bypass Docker completely. Still get the same error.
Made sure the repo name is lowercase by forcing project-data-repository/courses in the csproj.
So basically docker push works, but dotnet publish -t:PublishContainer still fails with CONTAINER1016 from the exact same shell.
Is there any way to get the container tooling to actually print which config/auth it’s trying to use? Or is this a known Windows quirk where it ignores DOCKER_CONFIG?

[engineering87]

CONTAINER1016

Make sure the SDK reads the same config.json Docker:

bash: DOCKER_CONFIG="$HOME/.docker" aspirate build

[axies20]

Here's logs, same

$ aspirate init

     _                    _           ___
    / \     ___   _ __   (_)  _ __   ( _ )
   / _ \   / __| | '_ \  | | | '__|  / _ \
  / ___ \  \__ \ | |_) | | | | |    | (_) |
 /_/   \_\ |___/ | .__/  |_| |_|     \___/
                 |_|
Handle deployments of a .NET Aspire AppHost


── Handle Initialization Defaults ──────────────────────────────────────────────────────────────────────────────────────
(?) Done: Set 'Container builder' to 'docker'.
Aspirate supports setting a fall-back value for projects that have not yet set a 'ContainerRegistry' in their csproj
file.
Would you like to set a fall-back value for the container registry? [y/n] (n): y
Please enter the container registry to use as a fall-back value:  registry.digitalocean.com
(?) Done: Set 'Container fallback registry' to 'registry.digitalocean.com'.
Aspirate supports setting a repository prefix for all for projects.
Would you like to set this value? [y/n] (n): y
Please enter the container repository prefix to use as a fall-back value: funiver-data-repository
(?) Done: Set 'Container repository prefix' to 'funiver-data-repository'.
(?) Done: Set 'Container fallback tag' to 'latest'.
Aspirate supports setting a custom directory for 'Templates' that are used when generating kustomize manifests.
Would you like to use a custom directory (selecting 'n' will default to built in templates ? [y/n] (n): n
(?) Done: Configuration for aspirate has been bootstrapped successfully at
'C:\Users\black\RiderProjects\funiverai\Aspire\FuniverAI.AppHost\.\aspirate.json'.

 ?? Execution Completed ??

black@DESKTOP-Q1QHG3L MINGW64 ~/RiderProjects/funiverai/Aspire/FuniverAI.AppHost (dev)
$ DOCKER_CONFIG="$HOME/.docker" aspirate build

     _                    _           ___
    / \     ___   _ __   (_)  _ __   ( _ )
   / _ \   / __| | '_ \  | | | '__|  / _ \
  / ___ \  \__ \ | |_) | | | | |    | (_) |
 /_/   \_\ |___/ | .__/  |_| |_|     \___/
                 |_|
Handle deployments of a .NET Aspire AppHost


── Handling Aspirate State ─────────────────────────────────────────────────────────────────────────────────────────────

── Handling Aspirate Secrets ───────────────────────────────────────────────────────────────────────────────────────────
Secrets are to be protected by a password

Please enter new Password:

black@DESKTOP-Q1QHG3L MINGW64 ~/RiderProjects/funiverai/Aspire/FuniverAI.AppHost (dev)
$ docker login registry.digitalocean.com
Authenticating with existing credentials... [Username: [email protected]]

i Info → To login with a different account, run 'docker logout' followed by 'docker login'


Login Succeeded

black@DESKTOP-Q1QHG3L MINGW64 ~/RiderProjects/funiverai/Aspire/FuniverAI.AppHost (dev)
$ DOCKER_CONFIG="$HOME/.docker" aspirate build

     _                    _           ___
    / \     ___   _ __   (_)  _ __   ( _ )
   / _ \   / __| | '_ \  | | | '__|  / _ \
  / ___ \  \__ \ | |_) | | | | |    | (_) |
 /_/   \_\ |___/ | .__/  |_| |_|     \___/
                 |_|
Handle deployments of a .NET Aspire AppHost


── Handling Aspirate State ─────────────────────────────────────────────────────────────────────────────────────────────

── Handling Aspirate Secrets ───────────────────────────────────────────────────────────────────────────────────────────
Secrets are to be protected by a password

Please enter new Password: ********************************
Please enter it again to confirm: ********************************
Secret State has been initialised!.

── Handling Configuration ──────────────────────────────────────────────────────────────────────────────────────────────
Successfully loaded existing aspirate bootstrap settings from '.'.

── Handling Aspire Manifest ────────────────────────────────────────────────────────────────────────────────────────────
Generating Aspire Manifest for supplied App Host
(?) Done:  Created Aspire Manifest At Path:
C:\Users\black\RiderProjects\funiverai\Aspire\FuniverAI.AppHost\manifest.json

── Selecting Required Components ───────────────────────────────────────────────────────────────────────────────────────

── Gathering Information about deployables ─────────────────────────────────────────────────────────────────────────────
Gathering container details for each project in selected components
(?) Done:  Populated container details cache for project Courses
(?) Done:  Populated container details cache for project Lessons
(?) Done:  Populated container details cache for project UserCoursesData
(?) Done:  Populated container details cache for project UserProfile
(?) Done:  Populated container details cache for project BFFTokenExchange
(?) Done:  Populated container details cache for project Yarp
Gathering Tasks Completed - Cache Populated.

── Handling Projects ───────────────────────────────────────────────────────────────────────────────────────────────────
Building all project resources, and pushing containers

Executing: dotnet publish
"C:\Users\black\RiderProjects\funiverai\Aspire\FuniverAI.AppHost\../../Courses/FuniverAI.Courses/FuniverAI.Courses.cspro
j" -t:PublishContainer --verbosity "quiet" --nologo -r "linux-x64" -p:ContainerRegistry="registry.digitalocean.com"
-p:ContainerRepository="funiver-data-repository/" -p:ContainerImageName="funiverai.courses" -p:ContainerImageTag="1.0.0"
C:\Users\black\RiderProjects\funiverai\Courses\FuniverAI.Courses.Infrastructure\Specification\CourseWithAnyTagsSpecifica
tion.cs(12,25): warning CS8604: Possible null reference argument for parameter 'source' in 'bool
Enumerable.Any<CourseTag>(IEnumerable<CourseTag> source, Func<CourseTag, bool> predicate)'.
[C:\Users\black\RiderProjects\funiverai\Courses\FuniverAI.Courses.Infrastructure\FuniverAI.Courses.Infrastructure.csproj
]
C:\Users\black\RiderProjects\funiverai\Courses\FuniverAI.Courses\Requests\PostPhotoRequest.cs(6,22): warning CS8618:
Non-nullable property 'Photo' must contain a non-null value when exiting constructor. Consider adding the 'required'
modifier or declaring the property as nullable.
[C:\Users\black\RiderProjects\funiverai\Courses\FuniverAI.Courses\FuniverAI.Courses.csproj]
C:\Users\black\RiderProjects\funiverai\Courses\FuniverAI.Courses\Requests\PostCourseRequest.cs(5,19): warning CS8618:
Non-nullable property 'Name' must contain a non-null value when exiting constructor. Consider adding the 'required'
modifier or declaring the property as nullable.
[C:\Users\black\RiderProjects\funiverai\Courses\FuniverAI.Courses\FuniverAI.Courses.csproj]
C:\Users\black\RiderProjects\funiverai\Courses\FuniverAI.Courses\Requests\GetCoursesByTagsRequest.cs(5,25): warning
CS8618: Non-nullable property 'Tags' must contain a non-null value when exiting constructor. Consider adding the
'required' modifier or declaring the property as nullable.
[C:\Users\black\RiderProjects\funiverai\Courses\FuniverAI.Courses\FuniverAI.Courses.csproj]
C:\Users\black\RiderProjects\funiverai\Courses\FuniverAI.Courses\Endpoints\PutCoursesEndpoint.cs(53,23): warning CS8601:
Possible null reference assignment.
[C:\Users\black\RiderProjects\funiverai\Courses\FuniverAI.Courses\FuniverAI.Courses.csproj]
C:\Users\black\RiderProjects\funiverai\Courses\FuniverAI.Courses\Endpoints\DeleteCoursesEndpoint.cs(53,33): warning
CS8604: Possible null reference argument for parameter 'entity' in 'void
IWriteRepository<CoursesModel>.Delete(CoursesModel entity)'.
[C:\Users\black\RiderProjects\funiverai\Courses\FuniverAI.Courses\FuniverAI.Courses.csproj]
C:\Users\black\RiderProjects\funiverai\Courses\FuniverAI.Courses\Endpoints\PatchVisibleCoursesEndpoint.cs(51,9): warning
CS8602: Dereference of a possibly null reference.
[C:\Users\black\RiderProjects\funiverai\Courses\FuniverAI.Courses\FuniverAI.Courses.csproj]
C:\Program Files\dotnet\sdk\9.0.304\Containers\build\Microsoft.NET.Build.Containers.targets(84,5): warning CONTAINER003:
The property 'ContainerImageName' was set but is obsolete - please use 'ContainerRepository' instead.
[C:\Users\black\RiderProjects\funiverai\Courses\FuniverAI.Courses\FuniverAI.Courses.csproj]
C:\Program Files\dotnet\sdk\9.0.304\Containers\build\Microsoft.NET.Build.Containers.targets(250,5): error CONTAINER1016:
Unable to access the repository 'funiverai.courses' in the registry 'registry.digitalocean.com'. Please confirm your
credentials are correct and that you have access to this repository and registry.
[C:\Users\black\RiderProjects\funiverai\Courses\FuniverAI.Courses\FuniverAI.Courses.csproj]
Error executing action 'BuildAndPushContainersFromProjectsAction': Exception of type
'Aspirate.Shared.Exceptions.ActionCausesExitException' was thrown.
(1): Aspirate will now exit.

[engineering87]

Check if there any credential helper, check for "credsStore" or "credHelpers" in the ~/.docker/config.json.

[axies20]

Check if there any credential helper, check for "credsStore" or "credHelpers" in the ~/.docker/config.json.

{
	"auths": {
		"https://index.docker.io/v1/": {
		},
		"registry.digitalocean.com": {
		}
	},
	"currentContext": "desktop-linux"
}

In my ~/.docker/config.json I had both inline auth tokens and a top-level credsStore. For safety I deleted the auth values before sharing the file. I also removed credsStore earlier during debugging to see if it was causing the error. So the original file did contain tokens, but since credsStore was present, the tooling might have been ignoring them.

[dota-devy]

dotnet/sdk-container-builds#501

Seems like this issue has been around for a while and affects dotnet publish as well