title: Switching to Windows Containers causing a "CannotPullContainerError... failed to resolve ref <image> ... Forbidden" despite working for Linux
body: <p>I have a windows container image which is stored within a private artifactory repository, and would like to deploy it to AWS Fargate. Unfortunately, I am getting the error:</p>
  <blockquote>
  <p>CannotPullContainerError: inspect image has been retried 1 time(s):
  failed to resolve ref
  &quot;my.local.artifactory.com:port/repo/project/branch:image@sha256:digest&quot;:
  failed to do request: Head
  &quot;https://my.local.artifactory.com:port/v2/repo/project/branch/manifests/sha256:digest&quot;:
  Forbidden</p>
  </blockquote>
  <p>Whenever my ecs service attempts to spin up a new task.</p>
  <p>We have existing linux applications running in AWS Fargate, which also pull (successfully) from our artifactory repo; however this will be our first Windows container deployment.
  Using terraform, I've been able to show that it is the switch to windows which is changing something, somewhere, to cause this. The error can be reproduced by switching our ecs_task_definition resource from:</p>
  <pre><code>resource &quot;aws_ecs_task_definition&quot; &quot;ecs_task_definition&quot; {
  cpu = 1024
  family = var.app_aws_name
  container_definitions = jsonencode([
  {
      name = var.app_aws_name
      image = &quot;my.local.artifactory.com:port/repo/**LINUX_PROJECT**/branch:image@sha256:digest&quot;
      cpu = 1024
      memory = 2048
      essential = true
      environment = [
          {
              name = &quot;ASPNETCORE_ENVIRONMENT&quot;
              value = var.aspnetcore_environment_value
          }
      ]
      portMappings = [
          {
              containerPort = 80
              hostPort = 80
              protocol = &quot;tcp&quot;
          },
          {
              containerPort = 443
              hostPort = 443
              protocol = &quot;tcp&quot;
          }
      ],
      logConfiguration = {
          logDriver = &quot;awslogs&quot;
          options = {
              awslogs-create-group = &quot;true&quot;
              awslogs-group = &quot;/ecs/${var.app_name_lower}&quot; 
              awslogs-region = var.region
              awslogs-stream-prefix = var.app_aws_name
          }
      }
  }
  ])
  
  memory = 2048
  network_mode = &quot;awsvpc&quot;
  
  requires_compatibilities = [
      &quot;FARGATE&quot;
  ]
  
  task_role_arn = aws_iam_role.ecs_execution_role.arn
  execution_role_arn = aws_iam_role.ecs_execution_role.arn
  </code></pre>
  <p>}</p>
  <p>to:</p>
  <pre><code>resource &quot;aws_ecs_task_definition&quot; &quot;ecs_task_definition&quot; {
  cpu = 1024
  family = var.app_aws_name
  container_definitions = jsonencode([
  {
      name = var.app_aws_name
      image = &quot;my.local.artifactory.com:port/repo/**WINDOWS_PROJECT**/branch:image@sha256:digest&quot;
      cpu = 1024
      memory = 2048
      essential = true
      environment = [
          {
              name = &quot;ASPNETCORE_ENVIRONMENT&quot;
              value = var.aspnetcore_environment_value
          }
      ]
      portMappings = [
          {
              containerPort = 80
              hostPort = 80
              protocol = &quot;tcp&quot;
          },
          {
              containerPort = 443
              hostPort = 443
              protocol = &quot;tcp&quot;
          }
      ],
      logConfiguration = {
          logDriver = &quot;awslogs&quot;
          options = {
              awslogs-create-group = &quot;true&quot;
              awslogs-group = &quot;/ecs/${var.app_name_lower}&quot; 
              awslogs-region = var.region
              awslogs-stream-prefix = var.app_aws_name
          }
      }
  }
  ])
  memory = 2048
  
  network_mode = &quot;awsvpc&quot;
  
  requires_compatibilities = [
      &quot;FARGATE&quot;
  ]
  
  **runtime_platform {
      operating_system_family = &quot;WINDOWS_SERVER_2019_CORE&quot;
      cpu_architecture        = &quot;X86_64&quot;
  }**
  
  task_role_arn = aws_iam_role.ecs_execution_role.arn
  execution_role_arn = aws_iam_role.ecs_execution_role.arn
  </code></pre>
  <p>}</p>
  <p>Keeping all other terraform resources the same, the first will work successfully, the latter will result in the error.</p>
  <p>Here's what I have tried:</p>
  <ol>
  <li>Triple, quadruple checked that the windows image does actually exist in artifactory.</li>
  <li>Pulled the image stored within artifactory, pushed it to ECR and had the task definition pull the image from there. This worked successfully, leading me to believe there is nothing wrong with the image itself, or any missing windows AWS configuration.</li>
  <li>Ensured that the windows image is set up in artifactory to allow anonymous user read access, in exactly the same way as our Linux images.</li>
  <li>Attempted to use AWS Secret Manager to connect to artifactory using an account regardless. (Unsuccessful)</li>
  <li>Attempted to use a non-ecr &quot;mcr.microsoft.com/windows/servercore/iis:windowsservercore-ltsc2019&quot; image, this allowed the task to run successfully.</li>
  <li>Checked our artifactory logs to see if any pull requests are actually making it there - no pull requests for that image have been logged which would lead me to believe that it's a network based infrastructure issue rather than permissions; however the pull works fine for linux containers keeping the security groups, VPC, and subnets otherwise the same!</li>
  </ol>
  <p>Due to point 6 I believe this to be network related, but for the life of me I cannot figure out what it is that changes between windows and linux containers that would cause this. The pull request still happens on port 443, and still comes from the same vpc/subnet, so i don't see how the firewall could be blocking it, and the security group is unchanged so again I do not see how that could be the issue.</p>
  <p>So my question is, what actually changes between linux/windows task definitions that could be causing this?</p>
  <p>...</p>
  <p>Or am i missing something, following a red herring?</p>
  <p>If there's any other information you'd like please ask and I'll add it here. I've tried to not bloat this too much.</p>
  <p>Cheers</p>