docker pull should prompt for login if pull fails and no current login

[metalivedev]

Problem

docker pull on a private repository will fail with "Error: image XXXXXX/YYYYY not found" unless you're logged in with a user account that has access to the repo.

If the user has never run docker push (which prompts for a login) then there may be no credentials in ~/.dockercfg and so the docker pull of the private repo fails with a misleading Error message (above).

Proposed solutions

Either:

1. Force a docker hub ID for every docker pull or
2. if the docker pull fails and there are no credentials, prompt for credentials and try again.

And:

If there are credentials, prompt with the Not Found error plus something like "Does account username have access to reponame?"

[estesp]

Due to the path that docker pull takes through the server code (ending up in registry/session.go performing the GetRepositoryData(remote string) function) the repository name is used to build up the GET request, but "/images" is appended, which is the source of the problem--as it would appear that nginx is happy to respond with 401 (auth required) for the base repository URI, but when "/images" is appended and the user has not basic-authed, nginx returns 404:

wget -S https://index.docker.io/v1/repositories/estesp/testpriv/images
HTTP request sent, awaiting response... 
  HTTP/1.1 404 NOT FOUND
  Server: nginx/1.7.1

Remove the "/images" portion of the URL:

wget -S https://index.docker.io/v1/repositories/estesp/testpriv/
HTTP request sent, awaiting response... 
  HTTP/1.1 401 OK
  Server: nginx/1.7.1

I assume there are a few options--one is to take the 404 error path--only in the case where authConfig is empty--and retry without "/images" to check for a 401 and then ask for user auth, else just return the original 404. The other seems more heavy handed--if no authConfig (or empty, to be specific), then always try the repo base URI first to check for 401. This would slow the path to get public repo images for which auth would not be required anyway. I'm willing to help with this if someone wants to state a preference.

Maybe another option is to poke at the nginx config around returning 401 on basic-auth URL paths--but that would require policing all kinds of repos that potentially already exist.

[metaver5o]

maybe you should input your credentials after the "docker login" command, than use "docker pull" after being logged in. cheers.

[jessfraz]

it prompts for credentials now afaik, but ping me if otherwise

[metalivedev]

released version of 1.5 does not prompt for credentials if a pull fails. @jfrazelle
current master version also does not prompt (tested master.dockerproject.com Client version: 1.5.0-dev Git commit (client): 9a2e58d)

root@testdd7892:~# docker pull rufus/secretsiege
Pulling repository rufus/secretsiege
FATA[0000] Error: image rufus/secretsiege:latest not found 

# Ok, let's add in some credentials
root@testdd7892:~# vi .dockercfg

root@testdd7892:~# docker pull rufus/secretsiege
Pulling repository rufus/secretsiege
5d6e1b594e13: Download complete 511136ea3c5a: Download complete 
d7ac5e4f1812: Download complete 
2f4b4d6a4a06: Download complete 
83ff768040a0: Download complete 
6c37f792ddac: Download complete 
e54ca5efa2e9: Download complete 
a300044931cb: Download complete 
c864c2a70e07: Download complete 
f34c40c7767e: Download complete 
869ff409816b: Download complete 
1eecc1e8c326: Download complete 
a69472484a58: Download complete 
d7877b63754e: Download complete 
6d154d4424c0: Download complete 
a93da672afb1: Download complete 
Status: Downloaded newer image for rufus/secretsiege:latest