GoogleCloudPlatform / GoogleCloudPlatform/gsutil

ServiceException 401 when running gsutil in docker container

Open
#1,599 1 comment 4 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
918
Forks
335
PR merge metrics
No merged PRs in 30d

Description

The `$GOOGLE_APPLICATION_CREDENTIALS` doesn't seem to work for `gsutil` in a docker container when gcloud is not installed.

For context, I'm working in a docker container which has no `gcloud` installed to minimize storage. The docker requires some files from Google cloud Storage which are copied when the entrypoint is executed.

Description
----------------

I am passing my credentials stored in my env variable `GOOGLE_APPLICATION_CREDENTIALS` during the docker run with:

```
ADC=$GOOGLE_APPLICATION_CREDENTIALS
docker run -v ${ADC}:/tmp/credentials.json:ro -e GOOGLE_APPLICATION_CREDENTIALS=/tmp/credentials.json my_image
```
When running the container, I can see the credentials exist in the by checking the `/tmp` folder. Please note the credentials I'm parsing are exactly the ones as I have locally and work to download via `gsutil`. So far so good.

However, when I run `gsutil cp ` in the container, I get the message:
```
ServiceException: 401 Anonymous caller does not have storage.objects.get access to the Google Cloud Storage object.
```

If I use the google-storage-cloud python option, and in the container I run something like
```python
import google.cloud.storage
google.cloud.storage.Client().download_blob_to_file(sys.argv[1], open(sys.argv[2], 'wb'))"
```
then it works, and the files successfully download from the in GCS. This suggest there is a problem with `gsutil`, not the credentials or authentication via $GOOGLE_APPLICATION_CREDENTIALS.

Expected behavior
---------------------------

I would expect `gsutil` to use the json credentials with no issues, in the same way google cloud storage in Python does.

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the `gsutil cp` command in a minimal Docker container with `GOOGLE_APPLICATION_CREDENTIALS` mounted, then compare its credential handling with the working Python client example. Done means `gsutil` authenticates with the mounted JSON credentials and downloads the requested Cloud Storage object.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker, python
Domain
authentication, cli, cloud
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.