docker / docker/docker-credential-helpers
Docker password still visible from credential store
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 1.3k
- Forks
- 195
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 5
Description
The reason of using this docker-credential-pass is to keep Docker password secure. Prior to this the password is stored in ~/.docker/config.json with a base64 encoding which can be easily decoded. However after following all the steps and successfully set up a credential store, I can still easily retrieve the password in plain text using this command: echo "<ServerURL>" | docker-credential-pass get
Is there something that I overlooked or didn't understand?
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the credential-store setup and the echo "<ServerURL>" | docker-credential-pass get command, then compare its output with the contents of ~/.docker/config.json. Read the credential helper entry point handling get and determine whether plaintext retrieval is expected or indicates a security problem. Done means the behavior is explained and, if incorrect, covered by a clear fix or test.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- cli, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 20/100