Security Enhancement: Safe Shell Escaping for Docker Registry Authentication

What problem will this feature address?

The current Docker registry authentication implementation does not work when using Google Artifact Registry (GAR).

"${registry.password}". When the password is a JSON key (standard for GAR), the double quotes inside the JSON break the shell command, leading to unauthorized errors even with correct credentials.

Current code pattern:

echo "${password}" | docker login --username "${username}" --password-stdin "${registryUrl}"

Affected files:

• packages/server/src/utils/providers/docker.ts
• packages/server/src/utils/cluster/upload.ts

Describe the solution you'd like

Refactor the codebase to consistently use the existing safeDockerLoginCommand utility function that properly escapes shell arguments. This function already exists in packages/server/src/services/registry.ts but is not exported or used consistently across the codebase.

Proposed changes:

1. Export safeDockerLoginCommand from packages/server/src/services/registry.ts
2. Replace all unsafe Docker login command constructions with calls to safeDockerLoginCommand
3. Improve error messages to be more generic and informative

Describe alternatives you've considered

• Alternative 1: Create a new utility function - but safeDockerLoginCommand already exists and works well

Additional context

Security benefits:

• Prevents shell injection attacks through malicious registry credentials
• Ensures proper escaping of special characters in usernames/passwords
• Maintains consistent security practices across the codebase

Impact:

• No breaking changes to existing functionality
• Improved security without affecting user experience
• Better code consistency and maintainability

Implementation status:
I have already implemented this fix and am ready to submit a PR. The changes preserve all existing functionality while significantly improving security.

Will you send a PR to implement it?

Yes

Start with packages/server/src/services/registry.ts to inspect safeDockerLoginCommand, then review the Docker login constructions in packages/server/src/utils/providers/docker.ts and packages/server/src/utils/cluster/upload.ts. Export and consistently use the existing utility, improve the relevant error messages, and verify that JSON-based GAR credentials and special characters are handled safely.