GoogleCloudPlatform / GoogleCloudPlatform/gsutil
ServiceException 401 when running gsutil in docker container
- Dominant language
- Python
- Stars
- 918
- Forks
- 335
- PR merge metrics
- No merged PRs in 30d
Description
The `$GOOGLE_APPLICATION_CREDENTIALS` doesn't seem to work for `gsutil` in a docker container when gcloud is not installed.
For context, I'm working in a docker container which has no `gcloud` installed to minimize storage. The docker requires some files from Google cloud Storage which are copied when the entrypoint is executed.
Description
----------------
I am passing my credentials stored in my env variable `GOOGLE_APPLICATION_CREDENTIALS` during the docker run with:
```
ADC=$GOOGLE_APPLICATION_CREDENTIALS
docker run -v ${ADC}:/tmp/credentials.json:ro -e GOOGLE_APPLICATION_CREDENTIALS=/tmp/credentials.json my_image
```
When running the container, I can see the credentials exist in the by checking the `/tmp` folder. Please note the credentials I'm parsing are exactly the ones as I have locally and work to download via `gsutil`. So far so good.
However, when I run `gsutil cp ` in the container, I get the message:
```
ServiceException: 401 Anonymous caller does not have storage.objects.get access to the Google Cloud Storage object.
```
If I use the google-storage-cloud python option, and in the container I run something like
```python
import google.cloud.storage
google.cloud.storage.Client().download_blob_to_file(sys.argv[1], open(sys.argv[2], 'wb'))"
```
then it works, and the files successfully download from the in GCS. This suggest there is a problem with `gsutil`, not the credentials or authentication via $GOOGLE_APPLICATION_CREDENTIALS.
Expected behavior
---------------------------
I would expect `gsutil` to use the json credentials with no issues, in the same way google cloud storage in Python does.
Contributor guide
Research direction
Start by reproducing the `gsutil cp` command in a minimal Docker container with `GOOGLE_APPLICATION_CREDENTIALS` mounted, then compare its credential handling with the working Python client example. Done means `gsutil` authenticates with the mounted JSON credentials and downloads the requested Cloud Storage object.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker, python
- Domain
- authentication, cli, cloud
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100