Improve token handling and cleanup in docker.md for Linux/Bash script - #14365
Conversation
|
@microsoft-github-policy-service agree |
|
Ian (@ianwallen) : Thanks for your contribution! The author(s) and reviewer(s) have been notified to review your proposed change. |
|
Can you review the proposed changes? IMPORTANT: When the changes are ready for publication, adding a #label:"aq-pr-triaged" |
There was a problem hiding this comment.
Pull request overview
Refactors the Azure Pipelines agent Docker start.sh example in docker.md to improve token handling, especially for service-principal-based tokens that can expire between agent startup and cleanup.
Changes:
- Introduces
load_azp_token()to centralize token acquisition and token-file writing. - Updates
cleanup()to refresh the token before removing agent configuration when using service principal credentials. - Changes the default
AZP_TOKEN_FILElocation to be relative to the script and expandsVSO_AGENT_IGNORE.
Refactor token loading and cleanup functions in docker for Linux/Bash script.
Fixes issue with this error during cleanup
WRITE ERROR: VS30063: You are not authorized to access https://dev.azure.com.
Also fixed issue with hard code AZP_TOKEN_FILE location being a hard coded path /azp/.token which may not exists. Changed it to use the same location as the script location.
|
Can you review this old PR and determine whether it needs to be closed or merged? @MicrosoftDocs/public-repo-pr-review-team |
|
Ian (@ianwallen) : Thanks for your contribution! The author(s) and reviewer(s) have been notified to review your proposed change. |
|
#sign-off |
|
Ian (@ianwallen) : Thanks for your contribution! The author(s) and reviewer(s) have been notified to review your proposed change. |
5e65f47
into
MicrosoftDocs:main
…s://github.com/MicrosoftDocs/azure-devops-docs (branch main) (#9558) * Update FAQ on Azure DevOps organization limits Revised the answer regarding the creation limits of Azure DevOps organizations for Microsoft Entra ID accounts, clarifying the conditions and support limitations. * Apply suggestion from @v-dirichards * Trivial updates to referencing "resolved" states (#14377) There were some minor typos when referring to "resolved" states, possibly from copy/pasting "In Progress" and only partially correcting after paste. * Clarify and update Azure DevOps rate limits documentation (#14379) * Update rate limits documentation for clarity Clarified conditions for assigning Basic + Test Plans access level and removed redundant information regarding Visual Studio Enterprise subscriptions. * Update rate limits documentation for Azure DevOps Clarified information regarding higher rate and usage limits for Azure DevOps integrations. Updated details on subscription requirements and conditions for assigning access levels. * Update rate limits documentation for Azure DevOps Clarified instructions for increasing rate limits for Azure DevOps integrations and specified conditions for Visual Studio Enterprise access level. * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --------- Co-authored-by: chcomley <35748196+chcomley@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * Remove preview note from Actual Result doc (now GA) (#14381) * Merge main to live (#9368) * ELM - start-migration expand and reorganize, add portal workflow, troubleshooting, pipeline rewiring (#9364) * Update start-migration documentation with new prerequisites and clarify agent startup instructions, additions * final updates * ELM - prerequisites expanded and improved (#9367) * updates * more updates * add WHY * Update docs/repos/enterprise-live-migrations/prerequisites.md Co-authored-by: learn-build-service-prod-08[bot] <274430765+learn-build-service-prod-08[bot]@users.noreply.github.com> --------- Co-authored-by: learn-build-service-prod-08[bot] <274430765+learn-build-service-prod-08[bot]@users.noreply.github.com> --------- Co-authored-by: learn-build-service-prod-08[bot] <274430765+learn-build-service-prod-08[bot]@users.noreply.github.com> * Merge MAIN to LIVE (#9411) * Add bulk attachment actions feature to Azure Boards (#9400) * Add bulk attachment actions feature to Azure Boards * Update release-notes/roadmap/2026/boards/bulk-attachment-actions.md Co-authored-by: learn-build-service-prod-09[bot] <274431102+learn-build-service-prod-09[bot]@users.noreply.github.com> * Update release-notes/roadmap/2026/boards/bulk-attachment-actions.md Co-authored-by: learn-build-service-prod-09[bot] <274431102+learn-build-service-prod-09[bot]@users.noreply.github.com> * Update release-notes/roadmap/2026/boards/bulk-attachment-actions.md Co-authored-by: learn-build-service-prod-09[bot] <274431102+learn-build-service-prod-09[bot]@users.noreply.github.com> * Refine description of bulk attachment actions feature Updated the description for bulk attachment actions in Azure Boards. * Update link for Copilot Code reviews in release notes * Update release-notes/roadmap/2026/boards/bulk-attachment-actions.md Co-authored-by: learn-build-service-prod-01[bot] <274427437+learn-build-service-prod-01[bot]@users.noreply.github.com> --------- Co-authored-by: learn-build-service-prod-09[bot] <274431102+learn-build-service-prod-09[bot]@users.noreply.github.com> Co-authored-by: learn-build-service-prod-01[bot] <274427437+learn-build-service-prod-01[bot]@users.noreply.github.com> * ELM prerequisites quick fix (#9410) * fix * clearer image --------- Co-authored-by: Dan Hellem <dahellem@microsoft.com> Co-authored-by: learn-build-service-prod-09[bot] <274431102+learn-build-service-prod-09[bot]@users.noreply.github.com> Co-authored-by: learn-build-service-prod-01[bot] <274427437+learn-build-service-prod-01[bot]@users.noreply.github.com> * Fix unrendered mx-imgBorder div (#14382) Fixes the `[!div class="mx-imgBorder"]` markup leaking into the rendered page in the "Enable or disable inheritance for a specific repository" section of Set Git repository permissions. Problem: The `[!div]` extension and its image were missing the blockquote (`>`) prefix, so DocFX didn't parse them as an extension and rendered `[!div class="mx-imgBorder"]` as literal text above the screenshot. Fix: Added the `>` prefix to both the `[!div]` line and the image line so they form a single blockquote, matching the correctly rendered usage in the "Set permissions for a specific user" section of the same file. * Update cumulative-flow-cycle-lead-time-guidance.md (#14384) * Update cumulative-flow-cycle-lead-time-guidance.md Removed duplicate sentences. * formatting fix Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --------- Co-authored-by: Diana Richards <103777760+v-dirichards@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * The domains vsassetscdn.azure.cn and gallerycdn.azure.cn are not valid domain names. Nevertheless, they are still utilized in the production environment of Azure DevOps and DevOps Marketplace. Kindly report this issue to the corresponding team to implement fixes. (#14389) The domains vsassetscdn.azure.cn and gallerycdn.azure.cn are not valid domain names. Nevertheless, they are still utilized in the production environment of Azure DevOps and DevOps Marketplace. Kindly report this issue to the corresponding team to implement fixes. * Update IP address instructions for GitHub hosted runners (#14351) Updated the link in Line 205 for "here" where it says "using the instructions provided here" from: https://docs.github.com/en/actions/concepts/runners/github-hosted-runners#ip-addresses To https://docs.github.com/en/actions/reference/runners/github-hosted-runners#ip-addresses * Fix required role (#14359) Compute Gallery Image Reader is less privileged role sufficient to create Managed DevOps Pool. * Improve token handling and cleanup in docker.md for Linux/Bash script (#14365) * Improve token handling and cleanup in docker.md for Linux/Bash script Refactor token loading and cleanup functions in docker for Linux/Bash script. Fixes issue with this error during cleanup WRITE ERROR: VS30063: You are not authorized to access https://dev.azure.com. Also fixed issue with hard code AZP_TOKEN_FILE location being a hard coded path /azp/.token which may not exists. Changed it to use the same location as the script location. * Fix potential endless loop on cleanup * Update docs/pipelines/agents/hosted.md Co-authored-by: learn-build-service-prod-06[bot] <274430002+learn-build-service-prod-06[bot]@users.noreply.github.com> --------- Co-authored-by: Ross McAllister <10053959+rmca14@users.noreply.github.com> Co-authored-by: learn-build-service-prod[bot] <113403604+learn-build-service-prod[bot]@users.noreply.github.com> Co-authored-by: Sam Grantham <36972300+SamGrantham@users.noreply.github.com> Co-authored-by: Diana Richards <103777760+v-dirichards@users.noreply.github.com> Co-authored-by: Learn Build Service GitHub App <Learn Build Service LearnBuild@microsoft.com> Co-authored-by: Steve Bonds <sbonds@gmail.com> Co-authored-by: chcomley <35748196+chcomley@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Co-authored-by: panos <188842228+panagiotisliaros@users.noreply.github.com> Co-authored-by: learn-build-service-prod-08[bot] <274430765+learn-build-service-prod-08[bot]@users.noreply.github.com> Co-authored-by: Dan Hellem <dahellem@microsoft.com> Co-authored-by: learn-build-service-prod-09[bot] <274431102+learn-build-service-prod-09[bot]@users.noreply.github.com> Co-authored-by: learn-build-service-prod-01[bot] <274427437+learn-build-service-prod-01[bot]@users.noreply.github.com> Co-authored-by: kinu <92515100+kinu404@users.noreply.github.com> Co-authored-by: melliott2024 <158214714+melliott2024@users.noreply.github.com> Co-authored-by: Jack Xu <Jack.xu@hotmail.com> Co-authored-by: arkoppan <58860099+arkoppan@users.noreply.github.com> Co-authored-by: Igor <igorpupkinable@users.noreply.github.com> Co-authored-by: Ian <ianwallen@hotmail.com> Co-authored-by: Steve Danielson <steved0x@github.com> Co-authored-by: learn-build-service-prod-06[bot] <274430002+learn-build-service-prod-06[bot]@users.noreply.github.com>
* Update FAQ on Azure DevOps organization limits Revised the answer regarding the creation limits of Azure DevOps organizations for Microsoft Entra ID accounts, clarifying the conditions and support limitations. * Apply suggestion from @v-dirichards * Trivial updates to referencing "resolved" states (#14377) There were some minor typos when referring to "resolved" states, possibly from copy/pasting "In Progress" and only partially correcting after paste. * Clarify and update Azure DevOps rate limits documentation (#14379) * Update rate limits documentation for clarity Clarified conditions for assigning Basic + Test Plans access level and removed redundant information regarding Visual Studio Enterprise subscriptions. * Update rate limits documentation for Azure DevOps Clarified information regarding higher rate and usage limits for Azure DevOps integrations. Updated details on subscription requirements and conditions for assigning access levels. * Update rate limits documentation for Azure DevOps Clarified instructions for increasing rate limits for Azure DevOps integrations and specified conditions for Visual Studio Enterprise access level. * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --------- Co-authored-by: chcomley <35748196+chcomley@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * Remove preview note from Actual Result doc (now GA) (#14381) * Merge main to live (#9368) * ELM - start-migration expand and reorganize, add portal workflow, troubleshooting, pipeline rewiring (#9364) * Update start-migration documentation with new prerequisites and clarify agent startup instructions, additions * final updates * ELM - prerequisites expanded and improved (#9367) * updates * more updates * add WHY * Update docs/repos/enterprise-live-migrations/prerequisites.md Co-authored-by: learn-build-service-prod-08[bot] <274430765+learn-build-service-prod-08[bot]@users.noreply.github.com> --------- Co-authored-by: learn-build-service-prod-08[bot] <274430765+learn-build-service-prod-08[bot]@users.noreply.github.com> --------- Co-authored-by: learn-build-service-prod-08[bot] <274430765+learn-build-service-prod-08[bot]@users.noreply.github.com> * Merge MAIN to LIVE (#9411) * Add bulk attachment actions feature to Azure Boards (#9400) * Add bulk attachment actions feature to Azure Boards * Update release-notes/roadmap/2026/boards/bulk-attachment-actions.md Co-authored-by: learn-build-service-prod-09[bot] <274431102+learn-build-service-prod-09[bot]@users.noreply.github.com> * Update release-notes/roadmap/2026/boards/bulk-attachment-actions.md Co-authored-by: learn-build-service-prod-09[bot] <274431102+learn-build-service-prod-09[bot]@users.noreply.github.com> * Update release-notes/roadmap/2026/boards/bulk-attachment-actions.md Co-authored-by: learn-build-service-prod-09[bot] <274431102+learn-build-service-prod-09[bot]@users.noreply.github.com> * Refine description of bulk attachment actions feature Updated the description for bulk attachment actions in Azure Boards. * Update link for Copilot Code reviews in release notes * Update release-notes/roadmap/2026/boards/bulk-attachment-actions.md Co-authored-by: learn-build-service-prod-01[bot] <274427437+learn-build-service-prod-01[bot]@users.noreply.github.com> --------- Co-authored-by: learn-build-service-prod-09[bot] <274431102+learn-build-service-prod-09[bot]@users.noreply.github.com> Co-authored-by: learn-build-service-prod-01[bot] <274427437+learn-build-service-prod-01[bot]@users.noreply.github.com> * ELM prerequisites quick fix (#9410) * fix * clearer image --------- Co-authored-by: Dan Hellem <dahellem@microsoft.com> Co-authored-by: learn-build-service-prod-09[bot] <274431102+learn-build-service-prod-09[bot]@users.noreply.github.com> Co-authored-by: learn-build-service-prod-01[bot] <274427437+learn-build-service-prod-01[bot]@users.noreply.github.com> * Fix unrendered mx-imgBorder div (#14382) Fixes the `[!div class="mx-imgBorder"]` markup leaking into the rendered page in the "Enable or disable inheritance for a specific repository" section of Set Git repository permissions. Problem: The `[!div]` extension and its image were missing the blockquote (`>`) prefix, so DocFX didn't parse them as an extension and rendered `[!div class="mx-imgBorder"]` as literal text above the screenshot. Fix: Added the `>` prefix to both the `[!div]` line and the image line so they form a single blockquote, matching the correctly rendered usage in the "Set permissions for a specific user" section of the same file. * Update cumulative-flow-cycle-lead-time-guidance.md (#14384) * Update cumulative-flow-cycle-lead-time-guidance.md Removed duplicate sentences. * formatting fix Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --------- Co-authored-by: Diana Richards <103777760+v-dirichards@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * The domains vsassetscdn.azure.cn and gallerycdn.azure.cn are not valid domain names. Nevertheless, they are still utilized in the production environment of Azure DevOps and DevOps Marketplace. Kindly report this issue to the corresponding team to implement fixes. (#14389) The domains vsassetscdn.azure.cn and gallerycdn.azure.cn are not valid domain names. Nevertheless, they are still utilized in the production environment of Azure DevOps and DevOps Marketplace. Kindly report this issue to the corresponding team to implement fixes. * Update IP address instructions for GitHub hosted runners (#14351) Updated the link in Line 205 for "here" where it says "using the instructions provided here" from: https://docs.github.com/en/actions/concepts/runners/github-hosted-runners#ip-addresses To https://docs.github.com/en/actions/reference/runners/github-hosted-runners#ip-addresses * Fix required role (#14359) Compute Gallery Image Reader is less privileged role sufficient to create Managed DevOps Pool. * Improve token handling and cleanup in docker.md for Linux/Bash script (#14365) * Improve token handling and cleanup in docker.md for Linux/Bash script Refactor token loading and cleanup functions in docker for Linux/Bash script. Fixes issue with this error during cleanup WRITE ERROR: VS30063: You are not authorized to access https://dev.azure.com. Also fixed issue with hard code AZP_TOKEN_FILE location being a hard coded path /azp/.token which may not exists. Changed it to use the same location as the script location. * Fix potential endless loop on cleanup * Add a note with workaround Azure Artifacts source when packages are m… (#14368) * Add a note with workaround Azure Artifacts source when packages are missing in Package drop down list. Added notes on handling package truncation in Azure Artifacts source when using Feeds with many packages. We are getting cases related to this issue since May 2022 or earlier. There was a fix released for more than 15k feeds but the issue is related to number of packages in the feed. Please reach out if you need reference to related bug and IcMs. * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * Fix links in artifacts.md for package promotion Updated links in the artifacts documentation to point to the correct paths. --------- Co-authored-by: chcomley <35748196+chcomley@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Co-authored-by: Steve Danielson <steved0x@github.com> * Fixed incorrect dotnet build configuration (#14247) * Fixed incorrect dotnet build configuration The documentation incorrectly used the configuration input parameter as the built command does not use that parameter. * Apply suggestion from @Copilot Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> --------- Co-authored-by: Diana Richards <v-dirichards@microsoft.com> Co-authored-by: Steve Danielson <steved0x@github.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Apply suggestions from code review Co-authored-by: learn-build-service-prod-04[bot] <274428985+learn-build-service-prod-04[bot]@users.noreply.github.com> --------- Co-authored-by: Ross McAllister <10053959+rmca14@users.noreply.github.com> Co-authored-by: learn-build-service-prod[bot] <113403604+learn-build-service-prod[bot]@users.noreply.github.com> Co-authored-by: Sam Grantham <36972300+SamGrantham@users.noreply.github.com> Co-authored-by: Diana Richards <103777760+v-dirichards@users.noreply.github.com> Co-authored-by: Learn Build Service GitHub App <Learn Build Service LearnBuild@microsoft.com> Co-authored-by: Steve Bonds <sbonds@gmail.com> Co-authored-by: chcomley <35748196+chcomley@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Co-authored-by: panos <188842228+panagiotisliaros@users.noreply.github.com> Co-authored-by: learn-build-service-prod-08[bot] <274430765+learn-build-service-prod-08[bot]@users.noreply.github.com> Co-authored-by: Dan Hellem <dahellem@microsoft.com> Co-authored-by: learn-build-service-prod-09[bot] <274431102+learn-build-service-prod-09[bot]@users.noreply.github.com> Co-authored-by: learn-build-service-prod-01[bot] <274427437+learn-build-service-prod-01[bot]@users.noreply.github.com> Co-authored-by: kinu <92515100+kinu404@users.noreply.github.com> Co-authored-by: melliott2024 <158214714+melliott2024@users.noreply.github.com> Co-authored-by: Jack Xu <Jack.xu@hotmail.com> Co-authored-by: arkoppan <58860099+arkoppan@users.noreply.github.com> Co-authored-by: Igor <igorpupkinable@users.noreply.github.com> Co-authored-by: Ian <ianwallen@hotmail.com> Co-authored-by: Steve Danielson <steved0x@github.com> Co-authored-by: Szél Péter <szelpeter@szelpeter.hu> Co-authored-by: Diana Richards <v-dirichards@microsoft.com> Co-authored-by: Hector <v-ndat@microsoft.com> Co-authored-by: learn-build-service-prod-04[bot] <274428985+learn-build-service-prod-04[bot]@users.noreply.github.com>
Refactor token loading and cleanup functions in docker Linux/Bash script to fix some bugs.
Fixes issue with this error during cleanup
WRITE ERROR: VS30063: You are not authorized to access https://dev.azure.com.This error happens because at agent start time, it will fetch a token using the client id/secret which works during startup. However the agent may wait for several hours/days before getting triggered and due to this long duration, the token that was fetched at startup is no longer valid during the cleanup therefore a new token should be fetched during cleanup.
Also fixed issue with hard code AZP_TOKEN_FILE location being a hard coded path
/azp/.tokenwhich may not exists. Changed it to use the same location as the script location.