Pre-login to private repo

[colebrumley]

I am trying to enable a service that runs an image from a private repo, but adding the repo's auth to ~/.dockercfg and/or /root/.docker/config.json does not apply the authentication until after boot. Similarly, if I manually run docker login my.repo.com, the creds are saved appropriately, but on reboot the service still fails, presumably because the login info hasn't been applied yet. If I wait until after boot and login normally, the image pulls fine. The console logs show:

Is there a way to pre-login to a private repo that persists and is applied pre-boot?

In case it helps, I tried adding links to network and cloud-init in the service file thinking that may delay the service starting long enough for the creds to be applied, but no luck. Here's what the service looks like now:

yolk:
  image: docker-repo.gonkulator.io/gonkulator/yolk:latest
  links: 
    - network
    - cloud-init
  ports:
    - "8000:8000"
  restart: always
  tty: true
  stdin_open: true
  volumes:
    - "/var/lib/rancher/conf:/var/lib/rancher/conf"
    - "/usr/bin/ros:/usr/bin/ros"
    - "/sbin/reboot:/sbin/reboot"

I have tried on RancherOS v0.3.1 and v0.3.2rc4. Neither works, but I only saw the auth message on v0.3.2rc4

[ibuildthecloud]

This is definitely an issue. The /root directory is not persisted across reboots, but beyond that the bigger issue is that the system init process will not send credentials for the pull regardless. We need to fix that. We do run into a catch 22 with private images. If you have a completely clean install you can't login prior to the pull. Maybe we should add credentials to the cloud-config.

This is bit odd though. Are you saying that you do docker pull docker-repo.gonkulator.io/gonkulator/yolk:latest and then on reboot it fails? It should work because you should not need to pull docker-repo.gonkulator.io/gonkulator/yolk:latest a second time.

[colebrumley]

No no, if I manually pull the image then reboot the service starts normally. Glad to see that I'm not missing something obvious!

You mentioned that /root is not persisted, but the rancher user's home directory is. An additional/alternative option for working around this issue might be to add a label to the service specifying what user to run as. I agree that cloud-config would be the natural place for repo credentials in general though.

[ldejager]

I'm having the same issue as reported, has there been any progress on this by any chance?

[quantverse]

Any progress on this one? This is a critical defect. I can't run my application as services, because some images are private.

[deniseschannon]

In v0.4.0+, we have added this ability to add certificates for private registries. Would this solve what is being asked?

http://docs.rancher.com/os/configuration/docker/#certificates-for-private-registries

[quantverse]

Hello,

that would work if Docker Hub supported certificates. But I have to login using the docker login command and my username/password to access my private repositories. This information is then stored in ~/.docker/config.json, co creating this file is equivalent to using the command. But this does not seem to work when launching services from cloud-config.

[ldejager]

+1 to the above

[tylerFowler]

+1 as well, I'm using private repos on Docker Hub and Terraform for infra management so it would be nice if I could include docker login credentials (either username/password or username/passhash) in the cloud config I pass into the user data on EC2 instead of a provisioning block after instance creation.

[deniseschannon]

I have been able to figure out how to do this with the help of @ibuildthecloud and using v0.4.1.

In your cloud-config, you can write the json credentials to the appropriate directory. You can find your docker login credentials by doing a docker login locally and finding the location of where the login credentials are saved.

#cloud-config
write_files:
  - path: /home/rancher/.docker/config.json
    permissions: "0755"
    owner: rancher
    content: |
      {
         "auths": {
               "https://index.docker.io/v1/": {
                    "auth": "asdf=",
                   "email": "not@val.id" 
                   }  
            }
     }

I will be adding this to the documentation. Note: you could do this same write_files directive for any private repo.

[deniseschannon]

Note: You can pre-login to these repositories but it won't allow you to start using them on services you also want launched through the cloud-config file.

I've created #685 to add this ability.

[quantverse]

It is exactly like @deniseschannon says...you can use write_files to save the config.json file for docker and it will be used as long you login to the system, but it won't allow you to use the authentication for services specified in cloud-config.