docker / docker/cli

Can't search private registry with credential helper enabled

Open
#1,161 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

area/authentication area/distribution kind/bug
Dominant language
Go
Stars
6.1k
Forks
2.2k
Avg merge
1d 15h
Merged PRs (30d)
43

Description

Description

docker search fails when using docker-credential-osxkeychain as credential backend.

Steps to reproduce the issue:

  1. Have "credsStore": "osxkeychain" in your ~/.docker/config.json
  2. docker login ip:port on a DTR
  3. docker search ip:port/alpine on a DTR

Describe the results you received:

Error response from daemon: Unexpected status code 500

But looking at the DTR error, this is due to missing authentication.

Additional information you deem important (e.g. issue happens only occasionally):

When using unsecure credential storage, it works. So DTR seems to be ok.

The DTR certificate is self-signed and I added it to insecure-registries in daemon.json

Output of docker version:

Client:
 Version:      18.05.0-ce
 API version:  1.37
 Go version:   go1.9.5
 Git commit:   f150324
 Built:        Wed May  9 22:12:05 2018
 OS/Arch:      darwin/amd64
 Experimental: false
 Orchestrator: swarm

Server:
 Engine:
  Version:      18.05.0-ce
  API version:  1.37 (minimum version 1.12)
  Go version:   go1.10.1
  Git commit:   f150324
  Built:        Wed May  9 22:20:16 2018
  OS/Arch:      linux/amd64
  Experimental: true

Additional environment details (AWS, VirtualBox, physical, etc.):

Using a DTR

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing docker search ip:port/alpine with credsStore set to osxkeychain, after logging in to the DTR and configuring its certificate as described. Trace the Docker CLI's search authentication and credential-helper handling. Done means private-registry search authenticates successfully with the credential helper enabled and no longer returns the 500 error.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker, go
Domain
authentication, cli
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.