Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Parsing config.json for Auth on Mac OS with "credsStore": "osxkeychain" fails #677

michaeldye opened this issue Oct 9, 2017 · 4 comments


Copy link

@michaeldye michaeldye commented Oct 9, 2017

I have a Docker config file in ~/.docker/config.json with this content:

{ "auths": { "": {} }, "credsStore": "osxkeychain" }

... I get an ErrCannotParseDockercfg returned from .

Copy link

@fsouza fsouza commented Oct 10, 2017

@michaeldye hey, thanks for reporting this. We can fix the parsing issue, but right now go-dockerclient isn't integrated with osxkeychain and wouldn't be able to retrieve your credentials there.

I think that you could use docker's helpers to load the data from the keychain (, then construct AuthConfiguration from the data you get from the keychain.

Doing that in go-dockerclient would make go-dockerclient require CGO, which isn't really worth it. There could be a package that given a serverURL returns a go-dockerclient's AuthConfiguration, but that couldn't live inside go-dockerclient.

Copy link

@coodix coodix commented Jan 24, 2018

@fsouza hey, the workaround by manual adding auth base64 encoded string to config.json could be easy:
{ "auths": { "": {}, "localhost:5000": { "auth": "...base64encoded credentials..." } }, "credsStore": "osxkeychain" }
But another problem is that if any of auths doesn't have auth string then authConfigs function from auth.go fails with error "ErrCannotParseDockercfg". That makes impossible this workaround.

Do you consider returning error only if there are no one valid auth string in config file?

Copy link

@fsouza fsouza commented Jan 26, 2018

Hey @coodix, thanks for the feedback. YEah, that makes sense. I'm gonna modify the code to behave as you suggested. Thank you very much!

Copy link

@wuestkamp wuestkamp commented Jan 11, 2019

So I solved this on OSX by disabling the keychain password storage:

  1. rm ~/.docker/config.json
  2. in Docker for Mac preferences, untick "Securely store Docker logins in macOS keychain"
  3. restart Docker for Mac
  4. docker login

Or for glcoud and pushing to gcr:
gcloud auth print-access-token | docker login -u oauth2accesstoken --password-stdin

now your ~/.docker/config.json should contain base64 encoded passwords. Working, not safe though!

If someone gets the keychain storage to work that would be nice...

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
None yet

No branches or pull requests

4 participants