aws / aws/aws-cdk

(assets): docker login clashes with ecr-login

Open
#32,925 7 comments 8 reactions 0 assignees View on GitHub
@aws-cdk/assets bug effort/medium p1
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
2d 3h
Merged PRs (30d)
83

Description

### Describe the bug

This is a reopening of https://github.com/aws/aws-cdk/issues/14265, which was closed for inactivity. However, allowing usage of https://github.com/awslabs/amazon-ecr-credential-helper has become substantially more urgent because ECR have recently made a change to increase the length of tokens beyond the size that the Windows credential manager can store, 2500 characters. This is completely breaking for Windows users of Docker with ECR, and as amazon-ecr-credential-helper does not work with CDK and https://github.com/dougrday/docker-credential-plaintext did not work for me, Windows users are left with no option other than to code their own credential manager (or patch amazon-ecr-credential-helper to behave as though `AWS_ECR_IGNORE_CREDS_STORAGE=true` were set).

The only reason I'm not completely blocked by this is because I have an EC2 Ubuntu machine configured that I can use to do my CDK deploys.

See https://github.com/aws/aws-cli/issues/5636 and https://github.com/aws/containers-roadmap/issues/1589 for context.

### Regression Issue

- [ ] Select this option if this issue appears to be a regression.

### Last Known Working CDK Version

_No response_

### Expected Behavior

Either to be able to use amazon-ecr-credential-helper with CDK, or for ECR tokens to comply with the 2,500 character limit Windows Credential Manager imposes.

### Current Behavior

No way to use CDK Docker on Windows.

The actual issue I face is that when I try and use amazon-ecr-credential-helper, I need to set `AWS_ECR_IGNORE_CREDS_STORAGE=true`, as CDK expects to be able to use `docker login` with the credentials it receives. However when I call the CDK CLI with that environment variable set, I still see the `Error saving credentials: error storing credentials - err: exit status 1, out: `not implemented` error from Docker, indicating that however CDK invokes Docker, that environment variable is presumably not passed through.

### Reproduction Steps

Perform any deploy involving Docker on Windows.

### Possible Solution

_No response_

### Additional Information/Context

_No response_

### CDK CLI Version

n/a

### Framework Version

_No response_

### Node.js Version

n/a

### OS

Windows and WSL

### Language

Python, TypeScript, Java, .NET, Go

### Language Version

_No response_

### Other information

_No response_

Contributor guide

Open the contributing guide

Research direction

Start by tracing the CDK CLI's Docker asset publishing and docker login invocation, focusing on whether AWS_ECR_IGNORE_CREDS_STORAGE is propagated to Docker on Windows and WSL. Reproduce a Docker deployment with amazon-ecr-credential-helper; done means ECR-backed Docker assets can deploy without the credential-storage error.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, docker, typescript
Domain
cli, cloud, devops
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.