# Authenticated docker pulls for GCP Artifact Registry?

**URL:** <https://discuss.circleci.com/t/authenticated-docker-pulls-for-gcp-artifact-registry/42194>\
**Category:** Build Environment\
**Tags:** gcp, docker, circle-yml, auth\
**Created:** [December 8, 2021, 5:55pm UTC](https://discuss.circleci.com/t/authenticated-docker-pulls-for-gcp-artifact-registry/42194 "2021-12-08T17:55:30Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![rwilcox](https://sea2.discourse-cdn.com/circleci/user_avatar/discuss.circleci.com/rwilcox/32/29661_2.png) [@rwilcox](https://discuss.circleci.com/u/rwilcox)\
**Post date:** [March 22, 2022, 5:06pm UTC](https://discuss.circleci.com/t/authenticated-docker-pulls-for-gcp-artifact-registry/42194/2 "2022-03-22T17:06:55Z")

</div>

This is the third Google result for me when I searched CircleCI + Artifact Registry. I got this working, so I’m going to document how I did it!

# Too Long; Didn’t Read

Turns out the [Authorizing with Google Cloud SDK for Container Registry](https://circleci.com/docs/2.0/google-auth/#authenticating-to-google-container-registry) works for Artifact Registry too! Follow the instructions and use your Artifact Registry URL to download it.

Your image value will look something like this:

`image: $REGION-docker.pkg.dev/$PROJECT_NAME/$REGISTRY_NAME/$CONTAINER_NAME:$TAG`

# Detailed Example

Here’s an executor block sample, assuming your region is us-central-1:

```
executors:
  basic:
    docker:
      - image: us-central1-docker.pkg.dev/your-project-name-here/your-artifact-registry-name-here/container-name:myTag
        auth:
          username: _json_key
          password: $GCS_AUTHORIZATION

```

## Tips:

1. As the CircleCI Container Registry documentation suggests, the value of `$GCS_AUTHORIZATION` is simply the [JSON service account key json file](https://cloud.google.com/iam/docs/creating-managing-service-account-keys#creating). Do not base64 encode it. Just paste the JSON directly into Circle - yes really - it’ll Just Work.
2. That username is `_json_key` only one underscore
3. When viewing the container in the Artifact Registry there’s a neat Copy button, which copies a correctly formatted URL. Click, paste it as the `image` value, no mess no muss.

Where does that `_json_key` username come from? Per the Artifact Registry Documentation on authentication (can’t link it because I’m too new of a user) there’s two variants: `_json_key` and `_json_key_base64`, the latter which means the password is base64 encode JSON not plain JSON. This username and authentication scheme works equally well, just use whichever variant fits your workflow (haha!) better.

Edit: where does this env variable come from? It _can_ come from a context!

---

_[View the full topic](https://discuss.circleci.com/t/authenticated-docker-pulls-for-gcp-artifact-registry/42194)._