Merge pull request #258 from CerebriumAI/docs/public-docker-hub-images-auth

Docs/public docker hub images auth

Author: milo157

cerebrium/container-images/defining-container-images.mdx

@@ -175,61 +175,62 @@ The base image selection shapes how an app runs in Cerebrium. While the default
 
 ### Supported Base Images
 
-Cerebrium supports several categories of base images to ensure system compatibility:
+Cerebrium supports several categories of base images to ensure system compatibility such as nvidia, ubuntu and python images.
 
 ```toml
 [cerebrium.deployment]
-# Default minimal image
-docker_base_image_url = "debian:bookworm-slim"
+docker_base_image_url = "debian:bookworm-slim" # Default minimal image
+#docker_base_image_url = "nvidia/cuda:12.0.1-runtime-ubuntu22.04" # CUDA-enabled images
+#docker_base_image_url = "ubuntu:22.04"  # debian images
 ```
 
-```toml
-[cerebrium.deployment]
-# CUDA-enabled images
-docker_base_image_url = "nvidia/cuda:12.0.1-runtime-ubuntu22.04"
-```
-
-The system accepts these image types:
+<Tip>
+  Starting with a minimal Debian or Ubuntu base image is recommended, as CUDA
+  images include many pre-installed components that increase container size.
+  While the relationship isn't strictly linear, larger container sizes generally
+  lead to longer cold-starts and build times. Begin with a lean base image and
+  add only essential components as needed.
+</Tip>
 
-#### Ubuntu-based CUDA Images
+#### Public Docker Hub Images with Namespaces
 
-All Ubuntu-based `nvidia/cuda` images that include Ubuntu are supported. These include the CUDA libraries necessary to provide GPU acceleration:
+When using public Docker Hub images that include a namespace (e.g., `bob/infinity`, `huggingface/transformers`), you need to be logged in to Docker Hub locally, even though the image is public. This is because Cerebrium reads your `~/.docker/config.json` to authenticate image pulls.
 
-```toml
-[cerebrium.deployment]
-docker_base_image_url = "nvidia/cuda:12.0.1-devel-ubuntu22.04"
+```bash
+# Login to Docker Hub with username (required for namespace/image format)
+docker login -u your-dockerhub-username
+# Enter your password or access token when prompted
 ```
 
-#### Debian and Ubuntu Base Images
-
-Any Debian or Ubuntu base image works as a foundation:
+After logging in, you can use the image in your configuration:
 
 ```toml
 [cerebrium.deployment]
-docker_base_image_url = "debian:bullseye"
+docker_base_image_url = "bob/infinity:latest"
 ```
 
-```toml
-[cerebrium.deployment]
-docker_base_image_url = "ubuntu:22.04"
-```
+<Note>
+  Official Docker Hub images without a namespace (like `python:3.11`,
+  `debian:bookworm`, `ubuntu:22.04`) work without requiring a Docker login. Only
+  images in the `namespace/image` format require authentication.
+</Note>
 
-#### Python Images
+<Warning>
+  Use `docker login -u username` instead of just `docker login`. The latter may
+  use Docker's web-based OAuth flow which creates tokens that are incompatible
+  with our build system.
+</Warning>
+
+#### Public AWS ECR Images
 
-Python images based on Debian bullseye or bookworm provide pre-configured Python environments:
+Public ECR images from the `public.ecr.aws` registry work without authentication:
 
 ```toml
 [cerebrium.deployment]
-docker_base_image_url = "python:3.11-bookworm"
+docker_base_image_url = "public.ecr.aws/lambda/python:3.11"
 ```
 
-<Tip>
-  Starting with a minimal Debian or Ubuntu base image is recommended, as CUDA
-  images include many pre-installed components that increase container size.
-  While the relationship isn't strictly linear, larger container sizes generally
-  lead to longer cold-starts and build times. Begin with a lean base image and
-  add only essential components as needed.
-</Tip>
+However, **private ECR images** require authentication. See [Using Private Docker Registries](/cerebrium/container-images/private-docker-registry) for setup instructions.
 
 ## Custom Runtimes
 

cerebrium/container-images/private-docker-registry.mdx

@@ -21,10 +21,16 @@ Based on your registry, login using one of the following commands:
 **Docker Hub:**
 
 ```bash
-docker login
-# Enter username and password/token when prompted
+docker login -u your-dockerhub-username
+# Enter your password or access token when prompted
 ```
 
+<Warning>
+  Use `docker login -u username` instead of just `docker login`. The latter may
+  use Docker's web-based OAuth flow which creates tokens that are incompatible
+  with our build system.
+</Warning>
+
 **AWS ECR:**
 
 ```bash
@@ -36,7 +42,7 @@ aws ecr get-login-password --region us-east-1 | \
 **Generic Registry:**
 
 ```bash
-docker login registry.company.com
+docker login -u your-username registry.company.com
 # Enter credentials when prompted
 ```