CLI plugins: look for executables in PATH

[imjasonh]

Tell us about your request

Today, docker CLI plugins must be executables at ~/.docker/cli-plugins/ named like docker-foo (invoked as docker foo)

Requiring that these executables be found at only and exactly the path ~/.docker/cli-plugins/ can make them harder to install. For example, you can't easily go install into that directory.

Instead, it might be simpler if the CLI plugin lookup logic additionally searched for docker-foo executables in the PATH as a fallback.

Which service(s) is this request for?

The docker CLI

Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?

I'm trying to simplify installation of docker CLI plugins.

Are you currently working around the issue?

Install instructions in READMEs or install.sh scripts that download/build and correctly place the executable in ~/.docker/cli-plugins.

Additional context

As precedent, credential helpers already look in the configured PATH for executables matching docker-credential-* matching the configured credHelpers map value.

There may be some overlap with #121

[chris-crone]

Hi @imjasonh, thanks for the feedback!

We intend for CLI plugins to be used internally at Docker to break up feature development and releases. We may reevaluate this in the future and build a management system. Our concern with doing so is that the current mechanism does not promote UX consistency and there's a risk that if we don't get it right, we'll confuse our users.

For those outside Docker, we think there are two paths forward (for now):

1. If you think the functionality should be added to the CLI, create an issue for discussion on docker/cli
2. If not, it should probably be a standalone tool

[imjasonh]

Thanks for your response, and that sounds totally reasonable. That also explains why the docs for CLI plugins are uhhh... hard to find. 😄

• If you think the functionality should be added to the CLI, create an issue for discussion on docker/cli

In my particular case, I'm interested in integrating container image signing using cosign, which is captured here: #269 and prototyped as very simple CLI plugins here: https://github.com/imjasonh/cosign-docker-cli-plugins

(it's already implemented as a standalone tool: https://github.com/sigstore/cosign)

If there's real interest in having these integrated into the docker CLI, I'd be very happy to help however I can, up to and including sending PRs to integrate them into the CLI.

[imjasonh]

Also docker/cli#3283

[chris-crone]

I think @justincormack's take on docker/cli#3283 is right. We need to rethink the UX of signing and signature enforcement in the CLI.

The all or nothing approach (irrespective of the signing system used) doesn't give users a good path forward.