How to authenticate for Custom Docker Container Actions that reference a private Docker image?

[gerald-lnj]

I have created a docker container action, that uses a dockerfile that references a private image in Github Packages:

# action.yaml
name: 'Sample Docker Container Action'
description: 'Sample'

runs:
  using: 'docker'
  image: 'Dockerfile'

# Dockerfile
FROM ghcr.io/my-org/my-repo:latest

runs:
  using: 'docker'
  image: 'Dockerfile'

I get this error message:

Build container for action use: '/home/runner/work/_actions/my-org/my-repo/feat/gha/Dockerfile'.
  /usr/bin/docker build -t c0a593:d085c3798a054f0fadc30e453c29a2bd -f "/home/runner/work/_actions/my-org/my-repo/feat/gha/Dockerfile" "/home/runner/work/_actions/my-org/my-repo/feat/gha"
  #0 building with "default" instance using docker driver
  
  #1 [internal] load build definition from Dockerfile
  #1 transferring dockerfile: 90B 0.0s done
  #1 DONE 0.1s
  
  #2 [internal] load metadata for ghcr.io/my-org/my-repo:latest
  #2 ERROR: failed to authorize: failed to fetch anonymous token: unexpected status from GET request to https://ghcr.io/token?scope=repository%3Amy-org%2Fmy-repo%3Apull&service=ghcr.io: 401 Unauthorized
  ------
   > [internal] load metadata for ghcr.io/my-org/my-repo:latest:
  ------
  Dockerfile:1
  --------------------
     1 | >>> FROM ghcr.io/my-org/my-repo:latest
  --------------------
  ERROR: failed to solve: ghcr.io/my-org/my-repo:latest: failed to resolve source metadata for ghcr.io/my-org/my-repo:latest: failed to authorize: failed to fetch anonymous token: unexpected status from GET request to https://ghcr.io/token?scope=repository%3Amy-org%2Fmy-repo%3Apull&service=ghcr.io: 401 Unauthorized

I've tracked the relevant function to this one based on the string outputs. I can't see a way to pass a CR_PAT token to the DockerBuild function. Is there any way to bypass this or can we only use public images?

runner/src/Runner.Worker/ActionManager.cs

Lines 602 to 622 in 3696b7d

	private async Task BuildActionContainerAsync(IExecutionContext executionContext, object data)
	{
	var setupInfo = data as ContainerSetupInfo;
	ArgUtil.NotNull(setupInfo, nameof(setupInfo));
	ArgUtil.NotNullOrEmpty(setupInfo.Container.Dockerfile, nameof(setupInfo.Container.Dockerfile));
	executionContext.Output($"##[group]Build container for action use: '{setupInfo.Container.Dockerfile}'.");
	// Build docker image with retry up to 3 times
	var dockerManager = HostContext.GetService<IDockerCommandManager>();
	int retryCount = 0;
	int buildExitCode = 0;
	var imageName = $"{dockerManager.DockerInstanceLabel}:{Guid.NewGuid().ToString("N")}";
	while (retryCount < 3)
	{
	buildExitCode = await dockerManager.DockerBuild(
	executionContext,
	setupInfo.Container.WorkingDirectory,
	setupInfo.Container.Dockerfile,
	Directory.GetParent(setupInfo.Container.Dockerfile).FullName,
	imageName);

This is a related community discussion: https://github.com/orgs/community/discussions/76636