Skip to content

allow for docker registry password to be a file #2419

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

allow for docker registry password to be a file #2419

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions .changeset/red-moose-design.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
---
"trigger.dev": patch
---

Allow for DOCKER_REGISTRY_PASSWORD to be a file path
47 changes: 41 additions & 6 deletions apps/supervisor/src/workloadManager/docker.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,13 +8,13 @@ import { env } from "../env.js";
import { getDockerHostDomain, getRunnerId, normalizeDockerHostUrl } from "../util.js";
import Docker from "dockerode";
import { tryCatch } from "@trigger.dev/core";
import { readFileSync } from "fs";

export class DockerWorkloadManager implements WorkloadManager {
private readonly logger = new SimpleStructuredLogger("docker-workload-manager");
private readonly docker: Docker;

private readonly runnerNetworks: string[];
private readonly auth?: Docker.AuthConfig;
private readonly platformOverride?: string;

constructor(private opts: WorkloadManagerOptions) {
Expand Down Expand Up @@ -43,15 +43,21 @@ export class DockerWorkloadManager implements WorkloadManager {
username: env.DOCKER_REGISTRY_USERNAME,
url: env.DOCKER_REGISTRY_URL,
});
} else {
this.logger.warn("🐋 No Docker registry credentials provided, skipping auth");
}
}

this.auth = {
private auth(): Docker.AuthConfig | undefined {
if (env.DOCKER_REGISTRY_USERNAME && env.DOCKER_REGISTRY_PASSWORD && env.DOCKER_REGISTRY_URL) {
return {
username: env.DOCKER_REGISTRY_USERNAME,
password: env.DOCKER_REGISTRY_PASSWORD,
password: getDockerPassword(),
serveraddress: env.DOCKER_REGISTRY_URL,
};
} else {
this.logger.warn("🐋 No Docker registry credentials provided, skipping auth");
}

return undefined;
}
Comment on lines +51 to 61
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue

Synchronous throw from getDockerPassword can crash create() before tryCatch; handle errors inside auth()

this.auth() calls getDockerPassword(), which may throw. Because arguments are evaluated before awaiting tryCatch(this.docker.createImage(...)), any synchronous throw here will bypass tryCatch and bubble out of create(), potentially crashing the supervisor. Wrap resolution and guard against empty/undefined passwords.

Apply this diff:

   private auth(): Docker.AuthConfig | undefined {
-    if (env.DOCKER_REGISTRY_USERNAME && env.DOCKER_REGISTRY_PASSWORD && env.DOCKER_REGISTRY_URL) {
-      return {
-        username: env.DOCKER_REGISTRY_USERNAME,
-        password: getDockerPassword(),
-        serveraddress: env.DOCKER_REGISTRY_URL,
-      };
-    }
-
-    return undefined;
+    if (!(env.DOCKER_REGISTRY_USERNAME && env.DOCKER_REGISTRY_PASSWORD && env.DOCKER_REGISTRY_URL)) {
+      return undefined;
+    }
+
+    try {
+      const password = getDockerPassword();
+      if (!password) {
+        this.logger.warn("🐋 Docker registry password resolved to empty/undefined, skipping auth", {
+          username: env.DOCKER_REGISTRY_USERNAME,
+          url: env.DOCKER_REGISTRY_URL,
+        });
+        return undefined;
+      }
+
+      return {
+        username: env.DOCKER_REGISTRY_USERNAME,
+        password,
+        serveraddress: env.DOCKER_REGISTRY_URL,
+      };
+    } catch (error) {
+      this.logger.error("🐋 Failed to resolve Docker registry password, skipping auth", { error });
+      return undefined;
+    }
   }
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
private auth(): Docker.AuthConfig | undefined {
if (env.DOCKER_REGISTRY_USERNAME && env.DOCKER_REGISTRY_PASSWORD && env.DOCKER_REGISTRY_URL) {
return {
username: env.DOCKER_REGISTRY_USERNAME,
password: env.DOCKER_REGISTRY_PASSWORD,
password: getDockerPassword(),
serveraddress: env.DOCKER_REGISTRY_URL,
};
} else {
this.logger.warn("🐋 No Docker registry credentials provided, skipping auth");
}
return undefined;
}
private auth(): Docker.AuthConfig | undefined {
if (!(env.DOCKER_REGISTRY_USERNAME && env.DOCKER_REGISTRY_PASSWORD && env.DOCKER_REGISTRY_URL)) {
return undefined;
}
try {
const password = getDockerPassword();
if (!password) {
this.logger.warn("🐋 Docker registry password resolved to empty/undefined, skipping auth", {
username: env.DOCKER_REGISTRY_USERNAME,
url: env.DOCKER_REGISTRY_URL,
});
return undefined;
}
return {
username: env.DOCKER_REGISTRY_USERNAME,
password,
serveraddress: env.DOCKER_REGISTRY_URL,
};
} catch (error) {
this.logger.error("🐋 Failed to resolve Docker registry password, skipping auth", { error });
return undefined;
}
}
🤖 Prompt for AI Agents 
In apps/supervisor/src/workloadManager/docker.ts around lines 51 to 61, auth()
currently calls getDockerPassword() directly which can synchronously throw and
escape the outer tryCatch in create(); wrap the getDockerPassword() call in an
internal try/catch so auth() never throws (catch errors and return undefined or
omit the password field), and additionally guard against empty/undefined
password values (if password is falsy return undefined or build the auth object
without the password) so create() cannot be crashed by a synchronous exception
from getDockerPassword().


async create(opts: WorkloadManagerCreateOptions) {
Expand Down Expand Up @@ -162,7 +168,7 @@ export class DockerWorkloadManager implements WorkloadManager {

// Ensure the image is present
const [createImageError, imageResponseReader] = await tryCatch(
this.docker.createImage(this.auth, {
this.docker.createImage(this.auth(), {
fromImage: imageRef,
...(this.platformOverride ? { platform: this.platformOverride } : {}),
})
Expand Down Expand Up @@ -270,3 +276,32 @@ async function readAllChunks(reader: NodeJS.ReadableStream) {
}
return chunks;
}

function getDockerPassword(): string | undefined {
if (!env.DOCKER_REGISTRY_PASSWORD) {
return undefined
}
if (!env.DOCKER_REGISTRY_PASSWORD.startsWith("file://")) {
return env.DOCKER_REGISTRY_PASSWORD;
}

const passwordPath = env.DOCKER_REGISTRY_PASSWORD.replace("file://", "");

console.debug(
JSON.stringify({
message: "🔑 Reading docker password from file",
passwordPath,
})
);

try {
const password = readFileSync(passwordPath, "utf8").trim();
return password;
} catch (error) {
console.error(`Failed to read docker password from file: ${passwordPath}`, error);
throw new Error(
`Unable to read docker password from file: ${error instanceof Error ? error.message : "Unknown error"
}`
);
}
}
Comment on lines +280 to +307
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🛠️ Refactor suggestion

Don’t throw on password file read failure; use structured logging and return undefined

Throwing here can crash the call site (see auth() comment). Prefer logging and returning undefined so the caller can skip auth. Also, use the project’s structured logger instead of console.* and fix minor style nits.

Apply this diff:

 function getDockerPassword(): string | undefined {
   if (!env.DOCKER_REGISTRY_PASSWORD) {
-    return undefined
+    return undefined;
   }
   if (!env.DOCKER_REGISTRY_PASSWORD.startsWith("file://")) {
     return env.DOCKER_REGISTRY_PASSWORD;
   }
 
   const passwordPath = env.DOCKER_REGISTRY_PASSWORD.replace("file://", "");
 
-  console.debug(
-    JSON.stringify({
-      message: "🔑 Reading docker password from file",
-      passwordPath,
-    })
-  );
+  moduleLogger.debug("🔑 Reading docker password from file", { passwordPath });
 
   try {
     const password = readFileSync(passwordPath, "utf8").trim();
     return password;
   } catch (error) {
-    console.error(`Failed to read docker password from file: ${passwordPath}`, error);
-    throw new Error(
-      `Unable to read docker password from file: ${error instanceof Error ? error.message : "Unknown error"
-      }`
-    );
+    moduleLogger.error("Failed to read docker password from file", {
+      passwordPath,
+      error,
+    });
+    return undefined;
   }
 }

Add this module-level logger once near the top of the file (outside the selected range):

// Module-level logger for helpers outside the class
const moduleLogger = new SimpleStructuredLogger("docker-workload-manager");
🤖 Prompt for AI Agents 
In apps/supervisor/src/workloadManager/docker.ts around lines 280 to 307, the
helper currently uses console.debug/console.error and throws on failing to read
a password file; change it to use the project’s module-level structured logger
and return undefined on failure instead of throwing so callers can skip auth.
Add the suggested moduleLogger declaration once near the top of the file
(outside this range): const moduleLogger = new
SimpleStructuredLogger("docker-workload-manager"); then replace console.debug
with moduleLogger.debug(...) including the same message and passwordPath, and in
the catch block call moduleLogger.warn or moduleLogger.error with a structured
object { message: "Failed to read docker password from file", passwordPath,
error: error instanceof Error ? error.message : String(error) } and return
undefined instead of throwing; keep the same behavior for non-file passwords and
undefined env values.