docker / docker/cli

CLI tools do not cache auth token

Open
#687 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

area/authentication version/1.12
Dominant language
Go
Stars
6.1k
Forks
2.2k
Avg merge
1d 15h
Merged PRs (30d)
43

Description

Description

CLI tools do not cache the registry auth token across invocations, even though token has expires_in field set to one hour

Steps to reproduce the issue:

  1. Perform an action against a registry that requires auth tokens
  2. Get 401 redirect to acquire token
  3. Acquire token with 3600 second expiration, and use it to perform operation
  4. Try registry operation again one second later

Describe the results you received:

CLI appears to have forgotten the auth token just obtained, and must go through the process acquiring it again.

Describe the results you expected:

After acquiring an auth token with an expires_in field, use that token until it expires.

Additional information you deem important (e.g. issue happens only occasionally):

Always happens.

Output of docker version:

Client:
 Version:         1.12.6
 API version:     1.24
 Package version: docker-1.12.6-32.git88a4867.el7.centos.x86_64
 Go version:      go1.7.4
 Git commit:      88a4867/1.12.6
 Built:           Mon Jul  3 16:02:02 2017
 OS/Arch:         linux/amd64

Server:
 Version:         1.12.6
 API version:     1.24
 Package version:
 Go version:      go1.7.6
 Git commit:      d9ad3fc
 Built:           Thu Oct 26 03:30:45 2017
 OS/Arch:         linux/amd64

Output of docker info:

Containers: 17
 Running: 17
 Paused: 0
 Stopped: 0
Images: 22
Server Version: 1.12.6
Storage Driver: overlay
 Backing Filesystem: extfs
Logging Driver: json-file
Cgroup Driver: cgroupfs
Plugins:
 Volume: local
 Network: overlay null bridge host
Swarm: inactive
Runtimes: runc
Default Runtime: runc
Security Options: seccomp selinux
Kernel Version: 4.13.9-coreos
Operating System: Container Linux by CoreOS 1520.8.0 (Ladybug)
OSType: linux
Architecture: x86_64
Number of Docker Hooks: 2
CPUs: 24
Total Memory: 62.88 GiB
Name: core01.tec1.tivo.com
ID: MXJB:SJWY:3OZ5:3JY6:6G7N:FYJX:D2HN:PBWX:3W7K:DTOV:LVGV:MLSO
Docker Root Dir: /var/lib/docker
Debug Mode (client): false
Debug Mode (server): false
Registry: https://index.docker.io/v1/
Insecure Registries:
 127.0.0.0/8
Registries:

Additional environment details (AWS, VirtualBox, physical, etc.):

running in CoreOS, with Artifactory as docker registry.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by tracing Docker CLI registry authentication and token handling, then reproduce the repeated registry operation against an authenticated Artifactory registry. The work is done when a token with an expires_in value is reused across invocations until it expires, without requiring another token acquisition.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker, go
Domain
authentication, cli
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.