# AAP failed to create container EE

**URL:** <https://forum.ansible.com/t/aap-failed-to-create-container-ee/4590>\
**Category:** Get Help\
**Tags:** aap, awx, ee\
**Created:** [March 27, 2024, 11:53am UTC](https://forum.ansible.com/t/aap-failed-to-create-container-ee/4590 "2024-03-27T11:53:28Z")\
**Posts on this page:** 19\
**Page:** 1

<div class="post-metadata">

**Author:** ![asmagana](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/asmagana/32/2963_2.png) [@asmagana](https://forum.ansible.com/u/asmagana)\
**Post date:** [March 27, 2024, 11:53am UTC](https://forum.ansible.com/t/aap-failed-to-create-container-ee/4590/1 "2024-03-27T11:53:28Z")

</div>

Continuing the discussion from [Initial instalation AWX 24.0.0](http://forum.ansible.com/t/initial-instalation-awx-24-0-0/4538):

Did you get this to work? I have AAP 2.4 installed and running and a separate host has Private Hub running.

But a simple ad-hoc job is failing to create the EE.  
I have setup the API token in Credentials pointing to the Private Hub but the Control Plain EE just does get created to do a simple ping or uptime ad-hoc job.

I don’t know what I am missing.

---

<div class="post-metadata">

**Author:** ![Denney-tech](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/denney-tech/32/1556_2.png) [@Denney-tech](https://forum.ansible.com/u/Denney-tech)\
**Post date:** [March 27, 2024, 2:24pm UTC](https://forum.ansible.com/t/aap-failed-to-create-container-ee/4590/2 "2024-03-27T14:24:52Z")

</div>

AAP supports more deployment options than AWX does, so could you tell us how yours is deployed? For e.g. did you use an operator in OCP after subscribing to the catalog, or did you install the rpm based bundle to a standalone RHEL 8/9 vm?

Also, is the Control Plain EE downloaded to Private Hub already? Unfortunately, I don’t have experience with using the container registry feature of AH/Galaxy.

In my case, we’re subscribed to the operator in OCP 4.12, and pull all of our images from a local Quay Enterprise that proxies the upstream Red Hat registries.

---

<div class="post-metadata">

**Author:** ![asmagana](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/asmagana/32/2963_2.png) [@asmagana](https://forum.ansible.com/u/asmagana)\
**Post date:** [March 27, 2024, 2:42pm UTC](https://forum.ansible.com/t/aap-failed-to-create-container-ee/4590/3 "2024-03-27T14:42:32Z")

</div>

Installed with the bundle as a standalone disconnected to have its own database I deleted the EE’s and setup ansible private hub on a separate box and have the EE’s from the Private Hub to be pulled on jobs. My issue today is when I run an ad-hoc job against a test box from an inventory it spits out "Error container create failed ( no logs from conmon ) common bytes “”: readObjectStart: expect … I have seen some github issues related to this error but referring to podman, my issue is happening using the WebUI.

Thanks.

---

<div class="post-metadata">

**Author:** ![Denney-tech](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/denney-tech/32/1556_2.png) [@Denney-tech](https://forum.ansible.com/u/Denney-tech)\
**Post date:** [March 27, 2024, 2:57pm UTC](https://forum.ansible.com/t/aap-failed-to-create-container-ee/4590/4 "2024-03-27T14:57:58Z")

</div>

Okay, so I don’t have any experience with the standalone bundle, but from what I recall, it _does_ use podman. If that’s the case, maybe podman itself is unaware of your private hub or the credentials you provided. I would try configuring podman so that the host’s aap unix user can manually pull EE images from the private hub without needing to manually login first, and then see if AAP works.

---

<div class="post-metadata">

**Author:** ![asmagana](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/asmagana/32/2963_2.png) [@asmagana](https://forum.ansible.com/u/asmagana)\
**Post date:** [March 27, 2024, 4:10pm UTC](https://forum.ansible.com/t/aap-failed-to-create-container-ee/4590/5 "2024-03-27T16:10:50Z")

</div>

So this is what I did:

1. on the command line as my self on the AAP

2. sudo podman login --username myusername --password ( myldap-password ) “private.hub.url”  
3.Login Succeeded!

3. Went to the AAP WebUI

4. Re-Run my ad-hoc job I used a machine ssh credential with a different password

5. ERROR Initializing source docker://private.hub.url/ee-supported-rhel8:latest: Requesting bearer token: Invalid status code from registry 403 (forbidden)

---

<div class="post-metadata">

**Author:** ![Denney-tech](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/denney-tech/32/1556_2.png) [@Denney-tech](https://forum.ansible.com/u/Denney-tech)\
**Post date:** [March 27, 2024, 5:13pm UTC](https://forum.ansible.com/t/aap-failed-to-create-container-ee/4590/6 "2024-03-27T17:13:08Z")

</div>

Yeah no, AAP is running as UID:1000 or UID:1001 I presume, which is probably named either awx/aap. You need to create an auth.json file for _that_ user to implicitly login to your private hub. Logging into private hub under your user or as root won’t help.

E.g.  
/home/awx/.config/containers/auth.json

```json
{
  "auths": {
    "private.hub.url": {
      "auth": "base64encoded<username:password>",
      "email": ""
    }
  }
}

```

---

<div class="post-metadata">

**Author:** ![asmagana](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/asmagana/32/2963_2.png) [@asmagana](https://forum.ansible.com/u/asmagana)\
**Post date:** [March 27, 2024, 7:02pm UTC](https://forum.ansible.com/t/aap-failed-to-create-container-ee/4590/7 "2024-03-27T19:02:16Z")

</div>

So before doing the auth.json just to let you know awx id is 997 password is set to never expire. Should I have the awx user have an account on the Ansible Private Hub ?

---

<div class="post-metadata">

**Author:** ![Denney-tech](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/denney-tech/32/1556_2.png) [@Denney-tech](https://forum.ansible.com/u/Denney-tech)\
**Post date:** [March 27, 2024, 8:39pm UTC](https://forum.ansible.com/t/aap-failed-to-create-container-ee/4590/8 "2024-03-27T20:39:38Z")

</div>

Interesting. It may make sense to do that as a permanent solution, but at the moment, I’m just curious to know if this resolves the underlying problem. I haven’t had any time to really review the docs: [Red Hat Ansible Automation Platform Installation Guide Red Hat Ansible Automation Platform 2.4 - Disconnected Installation](https://access.redhat.com/documentation/en-us/red_hat_ansible_automation_platform/2.4/html-single/red_hat_ansible_automation_platform_installation_guide/index#disconnected-installation) to see what you’re expected to do for this scenerio.

---

<div class="post-metadata">

**Author:** ![asmagana](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/asmagana/32/2963_2.png) [@asmagana](https://forum.ansible.com/u/asmagana)\
**Post date:** [March 27, 2024, 9:19pm UTC](https://forum.ansible.com/t/aap-failed-to-create-container-ee/4590/9 "2024-03-27T21:19:40Z")

</div>

So when I create the auth.json content I am not sure what the password would be for awx so should I try awx-manage and generate a password for awx username ?

---

<div class="post-metadata">

**Author:** ![Denney-tech](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/denney-tech/32/1556_2.png) [@Denney-tech](https://forum.ansible.com/u/Denney-tech)\
**Post date:** [March 27, 2024, 9:28pm UTC](https://forum.ansible.com/t/aap-failed-to-create-container-ee/4590/10 "2024-03-27T21:28:19Z")

</div>

Under the awx/997 user’s home directory, create the auth.json file with _any valid private hub credential_, whether it’s yours or a service account specifically for AAP to use. I would not generate a password for the awx username from awx-manage because I have no idea what the consequences would be.

---

<div class="post-metadata">

**Author:** ![asmagana](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/asmagana/32/2963_2.png) [@asmagana](https://forum.ansible.com/u/asmagana)\
**Post date:** [March 27, 2024, 10:34pm UTC](https://forum.ansible.com/t/aap-failed-to-create-container-ee/4590/11 "2024-03-27T22:34:31Z")

</div>

I will let you know what happens I am at home and it’s a work related project so thanks for the advice can’t wait to get this working.

---

<div class="post-metadata">

**Author:** ![asmagana](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/asmagana/32/2963_2.png) [@asmagana](https://forum.ansible.com/u/asmagana)\
**Post date:** [March 28, 2024, 4:08pm UTC](https://forum.ansible.com/t/aap-failed-to-create-container-ee/4590/12 "2024-03-28T16:08:48Z")

</div>

I tried to run a job but got an error regarding the base64 username and password. Not sure if the auth.json username and password format. I see in your example you have username:password separated with a colon is that correct?

---

<div class="post-metadata">

**Author:** ![Denney-tech](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/denney-tech/32/1556_2.png) [@Denney-tech](https://forum.ansible.com/u/Denney-tech)\
**Post date:** [March 28, 2024, 5:02pm UTC](https://forum.ansible.com/t/aap-failed-to-create-container-ee/4590/13 "2024-03-28T17:02:05Z")

</div>

Yes, you could copy and paste the following into bash to generate the base64 string, and just that base64 string would be the value for “auth”.

```bash
read -p "UserName: " user 
read -p "Password: " -s pass
echo "${user}:${pass}" | base64

```

---

<div class="post-metadata">

**Author:** ![asmagana](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/asmagana/32/2963_2.png) [@asmagana](https://forum.ansible.com/u/asmagana)\
**Post date:** [March 28, 2024, 5:55pm UTC](https://forum.ansible.com/t/aap-failed-to-create-container-ee/4590/14 "2024-03-28T17:55:07Z")

</div>

I get ./script.sh line 2: read `-p’: not a valid identifier.

---

<div class="post-metadata">

**Author:** ![asmagana](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/asmagana/32/2963_2.png) [@asmagana](https://forum.ansible.com/u/asmagana)\
**Post date:** [March 28, 2024, 6:10pm UTC](https://forum.ansible.com/t/aap-failed-to-create-container-ee/4590/15 "2024-03-28T18:10:41Z")

</div>

I finally just wrote in a bash script:

#!/bin/bash

user=username  
pass=password  
echo “${user}:${pass}” | base64

I put that base64 string in the auth.json

Error now is Error: initializing source docker://private.automation.hub/ee-supported-rhel8:latest: Requesting bearer token: invalid status code from registry 403 (forbidden)

---

<div class="post-metadata">

**Author:** ![Denney-tech](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/denney-tech/32/1556_2.png) [@Denney-tech](https://forum.ansible.com/u/Denney-tech)\
**Post date:** [March 28, 2024, 6:11pm UTC](https://forum.ansible.com/t/aap-failed-to-create-container-ee/4590/16 "2024-03-28T18:11:44Z")

</div>

That’s what I get for going off memory. I have edited the post and tested. You’ll have to copy line-by-line since the prompt interrupts the clipboard.

---

<div class="post-metadata">

**Author:** ![Denney-tech](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/denney-tech/32/1556_2.png) [@Denney-tech](https://forum.ansible.com/u/Denney-tech)\
**Post date:** [March 28, 2024, 6:13pm UTC](https://forum.ansible.com/t/aap-failed-to-create-container-ee/4590/17 "2024-03-28T18:13:54Z")

</div>

I’m out of ideas then. Unless someone else here is familiar with this sort of scenario, I suggest you go make a support ticket with RedHat since you are already paying them for it.

---

<div class="post-metadata">

**Author:** ![asmagana](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/asmagana/32/2963_2.png) [@asmagana](https://forum.ansible.com/u/asmagana)\
**Post date:** [March 28, 2024, 6:57pm UTC](https://forum.ansible.com/t/aap-failed-to-create-container-ee/4590/18 "2024-03-28T18:57:34Z")

</div>

I appreciate it all the things you suggested. I know it will get up and authentication just gotta keep reading and it will happen.

---

<div class="post-metadata">

**Author:** ![anwarhub](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/anwarhub/32/4830_2.png) [@anwarhub](https://forum.ansible.com/u/anwarhub)\
**Post date:** [September 21, 2024, 5:50am UTC](https://forum.ansible.com/t/aap-failed-to-create-container-ee/4590/19 "2024-09-21T05:50:23Z")

</div>

Hi Andy

Did you get this sorted?  
I think it’s looking for your API token that you get from the PAH(Private Automation Hub)