Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Parsing `config.json` for Auth on Mac OS with "credsStore": "osxkeychain" fails #677

Closed
michaeldye opened this issue Oct 9, 2017 · 4 comments
Labels

Comments

@michaeldye
Copy link

@michaeldye michaeldye commented Oct 9, 2017

I have a Docker config file in ~/.docker/config.json with this content:

{ "auths": { "mydomain.org": {} }, "credsStore": "osxkeychain" }

... I get an ErrCannotParseDockercfg returned from https://github.com/fsouza/go-dockerclient/blob/master/auth.go#L138 .

@fsouza fsouza added bug unfortunate and removed bug labels Oct 10, 2017
@fsouza

This comment has been minimized.

Copy link
Owner

@fsouza fsouza commented Oct 10, 2017

@michaeldye hey, thanks for reporting this. We can fix the parsing issue, but right now go-dockerclient isn't integrated with osxkeychain and wouldn't be able to retrieve your credentials there.

I think that you could use docker's helpers to load the data from the keychain (https://github.com/docker/docker-credential-helpers/tree/master/osxkeychain), then construct AuthConfiguration from the data you get from the keychain.

Doing that in go-dockerclient would make go-dockerclient require CGO, which isn't really worth it. There could be a package that given a serverURL returns a go-dockerclient's AuthConfiguration, but that couldn't live inside go-dockerclient.

@coodix

This comment has been minimized.

Copy link

@coodix coodix commented Jan 24, 2018

@fsouza hey, the workaround by manual adding auth base64 encoded string to config.json could be easy:
{ "auths": { "dockerio.badoo.com": {}, "localhost:5000": { "auth": "...base64encoded credentials..." } }, "credsStore": "osxkeychain" }
But another problem is that if any of auths doesn't have auth string then authConfigs function from auth.go fails with error "ErrCannotParseDockercfg". That makes impossible this workaround.

Do you consider returning error only if there are no one valid auth string in config file?

@fsouza

This comment has been minimized.

Copy link
Owner

@fsouza fsouza commented Jan 26, 2018

Hey @coodix, thanks for the feedback. YEah, that makes sense. I'm gonna modify the code to behave as you suggested. Thank you very much!

@wuestkamp

This comment has been minimized.

Copy link

@wuestkamp wuestkamp commented Jan 11, 2019

So I solved this on OSX by disabling the keychain password storage:

  1. rm ~/.docker/config.json
  2. in Docker for Mac preferences, untick "Securely store Docker logins in macOS keychain"
  3. restart Docker for Mac
  4. docker login

Or for glcoud and pushing to gcr:
gcloud auth print-access-token | docker login -u oauth2accesstoken --password-stdin https://eu.gcr.io

now your ~/.docker/config.json should contain base64 encoded passwords. Working, not safe though!

If someone gets the keychain storage to work that would be nice...

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Linked pull requests

Successfully merging a pull request may close this issue.

None yet
4 participants
You can’t perform that action at this time.