I'm trying to sm-docker build a container derived from SageMaker Scikit-Learn framework container in ap-southeast-1, something like the following:

base_docker_uri = sagemaker.image_uris.retrieve(
    sagemaker.sklearn.defaults.SKLEARN_NAME,
    smsess.boto_region_name,
    version="0.23-1",
    instance_type="ml.m5.xlarge",
)
# 121021644041.dkr.ecr.ap-southeast-1.amazonaws.com/sagemaker-scikit-learn:0.23-1-cpu-py3

...so Dockerfile is FROM 121021644041.dkr....etc

Seems like the CLI tool spins up successfully and logs in to a load of other ECR registries, but not 121021644041: Then fails on step 1 with:

[Container] 2021/04/20 02:54:22 Running command docker build -t $IMAGE_REPO_NAME:$IMAGE_TAG .
Sending build context to Docker daemon   7.68kB
Step 1/2 : FROM 121021644041.dkr.ecr.ap-southeast-1.amazonaws.com/sagemaker-scikit-learn:0.23-1-cpu-py3
Get https://121021644041.dkr.ecr.ap-southeast-1.amazonaws.com/v2/sagemaker-scikit-learn/manifests/0.23-1-cpu-py3: no basic auth credentials

[Container] 2021/04/20 02:54:22 Command did not exit successfully docker build -t $IMAGE_REPO_NAME:$IMAGE_TAG . exit status 1

I've since tested and on a SageMaker Notebook Instance I can build the same Dockerfile fine, so long as I log in to the 121021644041 ECR first.

From a cursory look at the job logs and #12, it looks like the current strategy is to have the tool ecr login to every AWS account on which AWS DLCs are provided?

...So would the correct fix be to add every account Id listed here to support SKLearn?

I was thinking it might be preferable to also add a way for users to indicate extra required account IDs through the CLI, since:

• This list is going to start getting pretty long
• (Like in Added eu-west-1 registry #12 and this issue) I guess there might always be some gaps introducing bugs
• In some rarer cases, I guess users might have private cross-account ECR needs too?