New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Unable to push Docker image for service web: Unable to retrieve .docker/config.json authentication details. #911

Open
ruddra opened this Issue Jan 19, 2018 · 21 comments

Comments

Projects
None yet
@ruddra

ruddra commented Jan 19, 2018

I got this error while running: kompose up
I have been using the following docker-compose.yml:

version: '3'

services:
db:
image: mysql:5.5
container_name: db-container
ports:
- "3406:3306"
environment:
MYSQL_ROOT_PASSWORD: mypassword
MYSQL_USER: root
MYSQL_DATABASE: mydb
web:
build: .
container_name: web-container
command: python3 manage.py runserver 0.0.0.0:8000
volumes:
- .:/code
image: "ruddra/web-image"
ports:
- "8000:8000"
depends_on:
- db

I ran the following commands:

kompose convert --provider=openshift
kompose up --provider=openshift

I was able to push to my dockerhub repository using:
docker-compose push

@ruddra ruddra changed the title from nable to push Docker image for service web: Unable to retrieve .docker/config.json authentication details. to Unable to push Docker image for service web: Unable to retrieve .docker/config.json authentication details. Jan 19, 2018

@cdrage

This comment has been minimized.

Member

cdrage commented Jan 19, 2018

Hey @ruddra I've been trying to diagnose this issue.

I'm assuming you're using OS X?

@ruddra

This comment has been minimized.

ruddra commented Jan 20, 2018

I am using macOS high sierra :)

@cdrage

This comment has been minimized.

Member

cdrage commented Jan 20, 2018

@ruddra That'd be why :) Docker is running in a VM and I believe they changed the configuration location. I'll have to investigate.

Just wondering, but where is the configuration file specifically on your machine?

@cdrage cdrage self-assigned this Jan 20, 2018

@ruddra

This comment has been minimized.

ruddra commented Jan 21, 2018

In '~/.docker/config.json'

@coodix

This comment has been minimized.

Contributor

coodix commented Jan 24, 2018

Same issue for me. Trying use local private repo, but even after docker login keep getting error "FATA Error while deploying application: k.Transform failed: Unable to push Docker image for service proxy: Unable to retrieve .docker/config.json authentication details. Check that 'docker login' works successfully on the command line.: Failed to read authentication from dockercfg".

~/.docker/config.json is in place

@cdrage

This comment has been minimized.

Member

cdrage commented Jan 24, 2018

Hey @coodix @ruddra @kbroughton

I got time this week to get around to this issue, unfortunately, I don't have a Mac and I'm unable to run a VM (against licensing :() to diagnose it. So I need your help.

I'd like you all (or at least one of you) to these two things:

From this issue (pachyderm/pachyderm#2446) , let's try this:

  1. Can you please output what your DOCKER_CONFIG variable is for me. If it's blank, try the command below the run Kompose again and see if it succeeds.
echo $DOCKER_CONFIG
export DOCKER_CONFIG=~/.docker/ 

From this issue (fsouza/go-dockerclient#677)

  1. Can you output your .docker/config.json details for me and see if it contains osxkeychain? If you decide to comment in this issue with the configuration details, make sure you omit the auth variable 👍

I'm going to see if I can borrow a friends Mac or at least find one at the company lab which has one I can remote into!

Seems at the moment this issue is only affected Mac users.

Many thanks 💯

@coodix

This comment has been minimized.

Contributor

coodix commented Jan 24, 2018

@cdrage , $DOCKER_CONFIG is empty by default. I tried to set it to "~/.docker/" but it didn't help. Same error appeared.
Content of my ~/.docker/config.json:
{ "auths": { "https://index.docker.io/v1/": {}, "localhost:5000": {} }, "credsStore": "osxkeychain" }

But it became so after I execute "docker login localhost:5000" trying to make it work. In all cases same error.

@coodix

This comment has been minimized.

Contributor

coodix commented Jan 24, 2018

@cdrage , I've found out what's the problem. It's because dockerclient isn't integrated with osxkeychain. See fsouza/go-dockerclient#677

Also it relates to docker/for-mac#1584
Docker for Mac by default uses osxkeychain for storing credentials.

So the current solution is to edit config.json:
{ "auths": { "localhost:5000": { "auth": "...base64encoded credentials..." } }, "credsStore": "osxkeychain" }
And need to ensure that there are no auths without auth string (fsouza/go-dockerclient#677 (comment) ).

@coodix

This comment has been minimized.

Contributor

coodix commented Jan 24, 2018

@cdrage , do you consider adding empty AuthConfiguration as it stated in comment for PushImage method (github.com/fsouza/go-dockerclient/image.go):
// An empty instance of AuthConfiguration may be used for unauthenticated // pushes. // // See https://goo.gl/zPtZaT for more details. func (c *Client) PushImage(opts PushImageOptions, auth AuthConfiguration) error {

At least in case if no one auth was found by dockerlib.NewAuthConfigurationsFromDockerCfg?

@cdrage

This comment has been minimized.

Member

cdrage commented Jan 25, 2018

@coodix Yeah, that's for investigating.. It's difficult with oxskeychain, we'd have to either contribute an upstream change to the go-dockerclient library or implement Docker's client library.

We can try to do empty authentication to fix it.

@geekflyer

This comment has been minimized.

geekflyer commented Feb 26, 2018

I'm having the same issue on OSX when trying to push to gcr.io using the gcr credential helper.
I'm trying to update my pipeline with
pc update-pipeline -f pipeline.json --push-images
and I'm getting
error parsing auth: open /Users/geekflyer/.dockercfg: no such file or directory, try running docker login

my ~/.docker/config.json looks like this:

{
	"auths": {
		"gcr.io": {},
		"https://registry.gitlab.com": {},
		"registry.gitlab.com": {}
	},
	"HttpHeaders": {
		"User-Agent": "Docker-Client/17.09.0-ce (darwin)"
	},
	"credsStore": "osxkeychain",
	"credHelpers": {
		"asia.gcr.io": "gcr",
		"eu.gcr.io": "gcr",
		"gcr.io": "gcr",
		"staging-k8s.gcr.io": "gcr",
		"us.gcr.io": "gcr"
	}
}% 

What is the workaround for this? This is really blocking me to iterate on some pipelines.

@geekflyer

This comment has been minimized.

geekflyer commented Feb 26, 2018

on a related issue: While digging I found that the podspec pachyderm creates for pipeline workers contains imagePullPolicy: IfNotPresent . I'm somewhat new to k8s, but wouldn't it be better to simply specify imagePullPolicy: Always which would make specifying the --push-images flag obsolete?

@huntal

This comment has been minimized.

huntal commented Mar 28, 2018

I'm getting this issue on my project. I'm from Linux and there is my ~./docker/config.json :

        "auths": {
                "https://index.docker.io/v1/": {
                        "auth": "<somekey>="
                },
                "registry.gitlab.com": {
                        "auth": "<somekey>="
                }
        },
        "HttpHeaders": {
                "User-Agent": "Docker-Client/18.02.0-ce (linux)"
        }
}

My docker-compose file :

version: '2'

services:

  agon:
    build:
      context: ./agon
      dockerfile: Dockerfile
    image: agonnode:tag  
    container_name: Agon_iri
    hostname: agon
    volumes:
      - ./volumes/iota/iota.ini:/iri/iota.ini:ro
      - ./volumes/iota/ixi:/iri/ixi:rw
      - ./volumes/iota/mainnetdb:/iri/mainnetdb:rw
      - /etc/localtime:/etc/localtime:ro
    expose: 
      - "5556"
    ports:
      - "14600:14600/udp"
      - "15600:15600/tcp"
      - "14265:14265"
    restart: 'on-failure'

Here's my try to push the image :

➜  ultra-devops git:(kuberpod) ✗ docker login
Login with your Docker ID to push and pull images from Docker Hub. If you don't have a DockerID, head over to https://hub.docker.com to create one.
Username (hystenal): hystenal
Password:
Login Succeeded

➜  ultra-devops git:(kuberpod) ✗ docker-compose push
Pushing agon (agonnode:tag)...
The push refers to repository [docker.io/library/agonnode]
070ea77bff68: Preparing
8760e8a8ec65: Preparing
89f1160177db: Preparing
64a60834482b: Preparing
ce26c278ee53: Preparing
b30530a0b009: Waiting
7c4b5f9422c0: Waiting
26fac7fe251e: Waiting
db584c622b50: Waiting
52a7ea2bb533: Waiting
52f389ea437e: Waiting
88888b9b1b5b: Waiting
a94e0d5a7c40: Waiting
ERROR: denied: requested access to the resource is denied

➜  ultra-devops git:(kuberpod) ✗ kompose up
WARN Unsupported hostname key - ignoring
INFO Container name in service "agon" has been changed from "Agon_iri" to "Agon-iri"
INFO Build key detected. Attempting to build and push image 'agonnode:tag'
INFO Building image 'agonnode:tag' from directory 'agon'
INFO Image 'agonnode:tag' from directory 'agon' built successfully
INFO Pushing image 'library/agonnode:tag' to registry 'docker.io'
INFO Multiple authentication credentials detected. Will try each configuration.
INFO Attempting authentication credentials 'registry.gitlab.com
ERRO Unable to push image 'library/agonnode:tag' to registry 'docker.io'. Error: unauthorized: incorrect username or password
INFO Attempting authentication credentials 'https://index.docker.io/v1/
ERRO Unable to push image 'library/agonnode:tag' to registry 'docker.io'. Error: denied: requested access to the resource is denied
FATA Error while deploying application: k.Transform failed: Unable to push Docker image for service agon: unable to push docker image(s). Check that `docker login` works successfully on the command line
@hangyan

This comment has been minimized.

Member

hangyan commented Mar 28, 2018

@huntal seems like not a kompose issue, because docker-compose push is not working too. Maybe wrong dockerhub user namespace. The output shows that you are trying to push to library, this is the official image account.. The image format is <you-user-name>/<image-name>:<tag> I think.

@huntal

This comment has been minimized.

huntal commented Mar 28, 2018

Yup you were right my bad, just had to change the image tag key to your format @hangyan thanks again

@bhargav3

This comment has been minimized.

bhargav3 commented May 21, 2018

I pushed it manually and removed build from compose file. It worked!

It feels like kompose is having issues accessing the credentials to push the images.

@beltran

This comment has been minimized.

beltran commented Jul 10, 2018

Could kubernetes/kubernetes#63874 be related to this?

@fejta-bot

This comment has been minimized.

fejta-bot commented Oct 8, 2018

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle stale

@fejta-bot

This comment has been minimized.

fejta-bot commented Nov 7, 2018

Stale issues rot after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle rotten

@PeterBocan

This comment has been minimized.

PeterBocan commented Nov 12, 2018

This is still not working properly. I have no idea what's the problem (permissions? corrupted cache?)

INFO Build key detected. Attempting to build and push image 'x/fetcher'
INFO Building image 'x/fetcher' from directory 'x-fetcher'
INFO Image 'x/fetcher' from directory 'x-fetcher' built successfully
INFO Pushing image 'x/fetcher:latest' to registry 'docker.io'
WARN Unable to retrieve .docker/config.json authentication details. Check that 'docker login' works successfully on the command line.: Failed to read authentication from dockercfg
INFO Authentication credentials are not detected. Will try push without authentication.
INFO Attempting authentication credentials 'docker.io
ERRO Unable to push image 'x/fetcher:latest' to registry 'docker.io'. Error: denied: requested access to the resource is denied
FATA Error while deploying application: k.Transform failed: Unable to push Docker image for service fetcher: unable to push docker image(s). Check that `docker login` works successfully on the command line

note that both docker and docker-compose are pushing properly and I am running macOS 10.14 Mojave.

It seems like a file permission issue with kubernetes, which I've installed via homebrew. Also my kubectl is not reading anything from my desktop folder.

@ruddra

This comment has been minimized.

ruddra commented Nov 19, 2018

/remove-lifecycle rotten

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment