Accessing Azure Artifacts from a docker container in a Pipelines build

azure-pipelines.cd.yaml

resources:
- repo: self
queue:
  name: Hosted Ubuntu 1604
variables:
- group: Artifacts

steps:
- task: Docker@1
  displayName: 'Build an image'
  inputs:
    azureSubscriptionEndpoint: 'DemoSPNConnection'
    azureContainerRegistry: demo.azurecr.io
    arguments: '--build-arg ARTIFACTS_ENDPOINT=$(artifactsEndpoint) --build-arg ACCESS_TOKEN=$(artifactsAccessToken)'

- task: Docker@1
  displayName: 'Push an image'
  inputs:
    azureSubscriptionEndpoint: 'DemoSPNConnection'
    azureContainerRegistry: demo.azurecr.io
    command: 'Push an image'

trigger:
  batch: true
  branches:
    include:
    - master
  paths:
    exclude:
    - readme.md

azure-pipelines.ci.yaml

resources:
- repo: self
queue:
  name: Hosted Ubuntu 1604
variables:
- group: Artifacts

steps:
- task: Docker@1
  displayName: 'Build an image'
  inputs:
    azureSubscriptionEndpoint: 'DemoSPNConnection'
    azureContainerRegistry: demo.azurecr.io
    arguments: '--build-arg ARTIFACTS_ENDPOINT=$(artifactsEndpoint) --build-arg ACCESS_TOKEN=$(artifactsAccessToken)'

trigger: none

Dockerfile

FROM microsoft/dotnet:2.2.100-sdk AS build-env
WORKDIR /app

# Credit: https://stackoverflow.com/questions/53419491/azure-artifacts-gives-unauthorized-when-trying-to-build-dockerfile/53510966#53510966
# Personal access token to access Artifacts feed
ARG ACCESS_TOKEN
ARG ARTIFACTS_ENDPOINT

# Install the Credential Provider to configure the access
RUN wget -qO- https://raw.githubusercontent.com/Microsoft/artifacts-credprovider/master/helpers/installcredprovider.sh | bash

# Configure the environment variables
ENV NUGET_CREDENTIALPROVIDER_SESSIONTOKENCACHE_ENABLED true
ENV VSS_NUGET_EXTERNAL_FEED_ENDPOINTS "{\"endpointCredentials\": [{\"endpoint\":\"${ARTIFACTS_ENDPOINT}\", \"password\":\"${ACCESS_TOKEN}\"}]}"

# copy everything and build the project
COPY ./src ./
RUN dotnet restore -s ${ARTIFACTS_ENDPOINT} api/*.csproj
RUN dotnet publish api/*.csproj -c Release -o out

# build runtime image
FROM microsoft/dotnet:2.2-aspnetcore-runtime
WORKDIR /app
COPY --from=build-env /app/api/out ./
ENTRYPOINT ["dotnet", "api.dll"]
EXPOSE 443

Instead of creating and using Access Token you can use NuGetAuthenticate task and then use VSS_NUGET_ACCESSTOKEN env variable.

  - task: NuGetAuthenticate@0

  - task: Docker@2
    inputs:
      ...
      arguments: '--build-arg ACCESS_TOKEN=$(VSS_NUGET_ACCESSTOKEN)'