registry auth for docker service does not work on Windows

[dnovvak]

Credentials to authenticated docker registry are not passed to docker service on Windows after login:

client.login(username, password, registry=registry, reauth=True)
client.services.create([any_args])

On Centos7 it works fine.
Tested with AWS ECR.

Debug logs (red lines - Windows, green lines - Centos7):

[DEBUG]: Looking for auth entry for 'XXX.amazonaws.com'
[DEBUG]: No entry found
[DEBUG]: http://localhost:None "POST /v1.35/auth HTTP/1.1" 200 48
[DEBUG]: {u'IdentityToken': u'', u'Status': u'Login Succeeded'}
[DEBUG]: Looking for auth config
- [DEBUG]: Using credentials store "wincred"
[DEBUG]: Looking for auth entry for 'XXX.amazonaws.com'
- [DEBUG]: No entry found
- [DEBUG]: No auth config found
+ [DEBUG]: Found 'XXX.amazonaws.com'
+ [DEBUG]: Found auth config
[DEBUG]: http://localhost:None "POST /v1.35/services/create HTTP/1.1" 201 35
[DEBUG]: http://localhost:None "GET /v1.35/services/ixpf3gaiy0cep3qzj9ly302n6 HTTP/1.1" 200 None

Windows environment:

docker==2.7.0
docker-pycreds==0.2.1
Python 2.7.14
Client:
 Version:       17.12.0-ce
 API version:   1.35
 Go version:    go1.9.2
 Git commit:    c97c6d6
 Built: Wed Dec 27 20:05:22 2017
 OS/Arch:       windows/amd64

Server:
 Engine:
  Version:      17.12.0-ce
  API version:  1.35 (minimum version 1.12)
  Go version:   go1.9.2
  Git commit:   c97c6d6
  Built:        Wed Dec 27 20:12:29 2017
  OS/Arch:      linux/amd64
  Experimental: true

Centos7 environment:

docker==2.7.0
docker-pycreds==0.2.1
Python 2.7.5
Client:
 Version:       17.12.0-ce
 API version:   1.35
 Go version:    go1.9.2
 Git commit:    c97c6d6
 Built: Wed Dec 27 20:10:14 2017
 OS/Arch:       linux/amd64

Server:
 Engine:
  Version:      17.12.0-ce
  API version:  1.35 (minimum version 1.12)
  Go version:   go1.9.2
  Git commit:   c97c6d6
  Built:        Wed Dec 27 20:12:46 2017
  OS/Arch:      linux/amd64
  Experimental: false

[feliperuhland]

Hi @dnovvak, Have you tried any of the suggestions here: docker/docker-credential-helpers#24?

[dnovvak]

Thank you @feliperuhland for hint.

I just removed "credsStore": "wincred" from ~/.docker/config.json as suggested here and successfully deployed docker service with valid registry authentication:

[DEBUG]: Looking for auth entry for 'XXX.amazonaws.com'
[DEBUG]: No entry found
[DEBUG]: http://localhost:None "POST /v1.35/auth HTTP/1.1" 200 48
[DEBUG]: {u'IdentityToken': u'', u'Status': u'Login Succeeded'}
[DEBUG]: Looking for auth config
[DEBUG]: Looking for auth entry for 'XXX.amazonaws.com'
[DEBUG]: Found 'XXX.amazonaws.com'
[DEBUG]: Found auth config
[DEBUG]: http://localhost:None "POST /v1.35/services/create HTTP/1.1" 201 35
[DEBUG]: http://localhost:None "GET /v1.35/services/twclgt7acjuh3tz8uv717g1po HTTP/1.1" 200 None

This is a good workaround for the issue but there is one more interesting thing - docker login command from cli works fine with wincred:

> docker login XXX.amazonaws.com
Username: AWS
Password:
Login Succeeded

After that I can create service with docker py successfully:

[DEBUG]: Looking for auth config
[DEBUG]: Using credentials store "wincred"
[DEBUG]: Looking for auth entry for 'XXX.amazonaws.com'
[DEBUG]: Found auth config
[DEBUG]: http://localhost:None "POST /v1.35/services/create HTTP/1.1" 201 35
[DEBUG]: http://localhost:None "GET /v1.35/services/dvuywu1p5yktskprp9zgrn691 HTTP/1.1" 200 None

So in general there is something wrong with saving credentials to wincred I guess. I am not sure whether it is docker or docker py responsibility.

[shin-]

I'll take a look next time I'm on a Windows machine - thanks for the report.