Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

docker login compatibility issue #17571

Closed
stratdev3 opened this issue Feb 20, 2023 · 10 comments · Fixed by #17581
Closed

docker login compatibility issue #17571

stratdev3 opened this issue Feb 20, 2023 · 10 comments · Fixed by #17581
Labels
kind/bug Categorizes issue or PR as related to a bug. locked - please file new issue/PR Assist humans wanting to comment on an old issue or PR with locked comments.

Comments

@stratdev3
Copy link

stratdev3 commented Feb 20, 2023

Issue Description

There is a docker login registry compatiliby issue.

Steps to reproduce the issue

using the original docker command, everything works fine :

$ docker run -it --rm -v /var/run/docker.sock:/var/run/docker.sock docker sh
# echo "mypasswd" | docker login -u mylogin --password-stdin

WARNING! Your password will be stored unencrypted in /root/.docker/config.json.
Configure a credential helper to remove this warning. See
https://docs.docker.com/engine/reference/commandline/login/#credentials-store

Login Succeeded

but it fails with podman :

$ podman run -it --rm -v $XDG_RUNTIME_DIR/podman/podman.sock:/var/run/docker.sock docker sh
# echo "mypasswd" | docker login -u mylogin --password-stdin
Error response from daemon: login attempt to https://index.docker.io/v1/ failed with status: pinging container registry index.docker.io/v1/: invalid status code from registry 404 (Not Found)

Describe the results you received

unable to login to registry with podman

Describe the results you expected

The login to registry should succeed.

podman info output

$ podman version                                                                                                           125 х │ onedev@sdserver │ 09:12:49
Client:       Podman Engine
Version:      4.3.1
API Version:  4.3.1
Go Version:   go1.19.5
Built:        Tue Jan  1 01:00:00 1980
OS/Arch:      linux/amd64

Podman in a container

Yes

Privileged Or Rootless

Rootless

Upstream Latest Release

No

Additional environment details

Additional environment details

Test with Nixos 22.11 stable release

Additional information

No response

@stratdev3 stratdev3 added the kind/bug Categorizes issue or PR as related to a bug. label Feb 20, 2023
@vrothberg
Copy link
Member

Thanks for reaching out, @stratdev3!

The issue seems unrelated to running inside a container but Docker talking to the Podman socket.

DOCKER_HOST=unix:///$XDG_RUNTIME_DIR/podman/podman.sock docker login fails with the same error, so there's something wrong in the compat REST API.

@vrothberg vrothberg changed the title docker login compatibility issue inside container with bind sock docker login compatibility issue Feb 20, 2023
vrothberg added a commit to vrothberg/common that referenced this issue Feb 20, 2023
Add an option to not write back the credentials to the authfile or any
credential helper.  The `/auth` compat endpoint of Podman is currently
not using this code here which ultimately led to normalization errors
surfacing in containers/podman/issues/17571.

The new option allows the endpoint to use this function without writing
back the credentials.

Signed-off-by: Valentin Rothberg <vrothberg@redhat.com>
vrothberg added a commit to vrothberg/libpod that referenced this issue Feb 20, 2023
Use `auth.Login` as `podman login` does which parses and normalizes the
input addresses correctly, especially for docker.io.

[NO NEW TESTS NEEDED] as we do not have means to test logging into
docker.io in CI.

Fixes: containers#17571
Signed-off-by: Valentin Rothberg <vrothberg@redhat.com>
vrothberg added a commit to vrothberg/libpod that referenced this issue Feb 20, 2023
Use `auth.Login` as `podman login` does which parses and normalizes the
input addresses correctly, especially for docker.io.

[NO NEW TESTS NEEDED] as we do not have means to test logging into
docker.io in CI.

Fixes: containers#17571
Signed-off-by: Valentin Rothberg <vrothberg@redhat.com>
vrothberg added a commit to vrothberg/libpod that referenced this issue Feb 20, 2023
Use `auth.Login` as `podman login` does which parses and normalizes the
input addresses correctly, especially for docker.io.

[NO NEW TESTS NEEDED] as we do not have means to test logging into
docker.io in CI.

Fixes: containers#17571
Signed-off-by: Valentin Rothberg <vrothberg@redhat.com>
vrothberg added a commit to vrothberg/libpod that referenced this issue Feb 20, 2023
Use `auth.Login` as `podman login` does which parses and normalizes the
input addresses correctly, especially for docker.io.

[NO NEW TESTS NEEDED] as we do not have means to test logging into
docker.io in CI.

Fixes: containers#17571
Signed-off-by: Valentin Rothberg <vrothberg@redhat.com>
vrothberg added a commit to vrothberg/libpod that referenced this issue Feb 21, 2023
Use `auth.Login` as `podman login` does which parses and normalizes the
input addresses correctly, especially for docker.io.

[NO NEW TESTS NEEDED] as we do not have means to test logging into
docker.io in CI.

Fixes: containers#17571
Signed-off-by: Valentin Rothberg <vrothberg@redhat.com>
vrothberg added a commit to vrothberg/libpod that referenced this issue Feb 21, 2023
Use `auth.Login` as `podman login` does which parses and normalizes the
input addresses correctly, especially for docker.io.

[NO NEW TESTS NEEDED] as we do not have means to test logging into
docker.io in CI.

Fixes: containers#17571
Signed-off-by: Valentin Rothberg <vrothberg@redhat.com>
vrothberg added a commit to vrothberg/libpod that referenced this issue Feb 22, 2023
Use `auth.Login` as `podman login` does which parses and normalizes the
input addresses correctly, especially for docker.io.

[NO NEW TESTS NEEDED] as we do not have means to test logging into
docker.io in CI.

Fixes: containers#17571
Signed-off-by: Valentin Rothberg <vrothberg@redhat.com>
vrothberg added a commit to vrothberg/libpod that referenced this issue Feb 22, 2023
Use `auth.Login` as `podman login` does which parses and normalizes the
input addresses correctly, especially for docker.io.

[NO NEW TESTS NEEDED] as we do not have means to test logging into
docker.io in CI.

Fixes: containers#17571
Signed-off-by: Valentin Rothberg <vrothberg@redhat.com>
vrothberg added a commit to vrothberg/libpod that referenced this issue Mar 13, 2023
Use `auth.Login` as `podman login` does which parses and normalizes the
input addresses correctly, especially for docker.io.

[NO NEW TESTS NEEDED] as we do not have means to test logging into
docker.io in CI.

Fixes: containers#17571
Signed-off-by: Valentin Rothberg <vrothberg@redhat.com>
vrothberg added a commit to vrothberg/libpod that referenced this issue Mar 13, 2023
Use `auth.Login` as `podman login` does which parses and normalizes the
input addresses correctly, especially for docker.io.

[NO NEW TESTS NEEDED] as we do not have means to test logging into
docker.io in CI.

Fixes: containers#17571
Signed-off-by: Valentin Rothberg <vrothberg@redhat.com>
@cristianrgreco
Copy link

I see this PR just been merged, thanks! 🚀 Is there any ETA for when this would be released? 🙂

@vrothberg
Copy link
Member

@ashley-cui @mheon are there plans for another patch release?

@vrothberg
Copy link
Member

I see this PR just been merged, thanks! rocket Is there any ETA for when this would be released? slightly_smiling_face

@cristianrgreco if you need it in RHEL, please open a ticket in the Red Hat Bugzilla.

@stratdev3
Copy link
Author

thanks for patch

@mheon
Copy link
Member

mheon commented Mar 13, 2023 via email

@cristianrgreco
Copy link

cristianrgreco commented Mar 13, 2023

A patch would be amazing (or a lightning fast release of 4.5 😄), I am trying to integrate podman into our GHA pipelines and am totally blocked as our tests login to private registries. I am currently using 4.4.2 from here: https://download.opensuse.org/repositories/devel:kubic:libcontainers:unstable/Debian_Testing

@vrothberg
Copy link
Member

Thanks, @cristianrgreco!

@mheon this fix here sounds important. It's somehow surprising it didn't blow up before. It would require some backports in c/common.

@cristianrgreco
Copy link

cristianrgreco commented Mar 14, 2023

Could this issue also be the reason why IndexServerAddress is empty when calling "/info", or should I raise a new issue?

@vrothberg
Copy link
Member

Could this issue also be the reason why IndexServerAddress is empty when calling "/info", or should I raise a new issue?

Please open a new issue. Thank you!

vrothberg added a commit to vrothberg/common that referenced this issue Mar 21, 2023
Add an option to not write back the credentials to the authfile or any
credential helper.  The `/auth` compat endpoint of Podman is currently
not using this code here which ultimately led to normalization errors
surfacing in containers/podman/issues/17571.

The new option allows the endpoint to use this function without writing
back the credentials.

Signed-off-by: Valentin Rothberg <vrothberg@redhat.com>
vrothberg added a commit to vrothberg/libpod that referenced this issue Mar 22, 2023
Use `auth.Login` as `podman login` does which parses and normalizes the
input addresses correctly, especially for docker.io.

[NO NEW TESTS NEEDED] as we do not have means to test logging into
docker.io in CI.

Fixes: containers#17571
Signed-off-by: Valentin Rothberg <vrothberg@redhat.com>
vrothberg added a commit to vrothberg/libpod that referenced this issue Mar 22, 2023
Use `auth.Login` as `podman login` does which parses and normalizes the
input addresses correctly, especially for docker.io.

[NO NEW TESTS NEEDED] as we do not have means to test logging into
docker.io in CI.

Fixes: containers#17571
Signed-off-by: Valentin Rothberg <vrothberg@redhat.com>
TomSweeneyRedHat pushed a commit to TomSweeneyRedHat/podman that referenced this issue Mar 31, 2023
Use `auth.Login` as `podman login` does which parses and normalizes the
input addresses correctly, especially for docker.io.

This Cherry Picks containers#17581 and
brings in necessary changes to run_test.go from i
containers@5f86fae

Addreses: https://bugzilla.redhat.com/show_bug.cgi?id=2183601 and
https://bugzilla.redhat.com/show_bug.cgi?id=2183602 for the RHEL 8.8 and
9.2 ZeroDay

The original Fixed: containers#17571
Signed-off-by: Valentin Rothberg <vrothberg@redhat.com>
Signed-off-by: tomsweeneyredhat <tsweeney@redhat.com>
@github-actions github-actions bot added the locked - please file new issue/PR Assist humans wanting to comment on an old issue or PR with locked comments. label Aug 30, 2023
@github-actions github-actions bot locked as resolved and limited conversation to collaborators Aug 30, 2023
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
kind/bug Categorizes issue or PR as related to a bug. locked - please file new issue/PR Assist humans wanting to comment on an old issue or PR with locked comments.
Projects
None yet
Development

Successfully merging a pull request may close this issue.

4 participants