saltstack / saltstack/salt

[BUG] Docker ignores the credentials stored in /root/.docker/config.json

Open
#58,020 4 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug severity-medium
Dominant language
Python
Stars
15.7k
Forks
5.6k
Avg merge
2d 44m
Merged PRs (30d)
80

Description

Description
In salt 3000.3 docker ignores the credentials stored in /root/.docker/config.json and fails authenticating agains the private registry.

I'm using a masterless setup with salt 3000.3 without any docker registry defined in pillars, instead of that I have created the docker config file /root/.docker/config.json with the auth configuration from salt:

/root/.docker/config.json:
  file.managed:
    - source: salt://docker/templates/docker-config.json.jinja
    - template: jinja
    - user: root
    - group: root
    - makedirs: True
    - mode: '0600'

This file contains a valid authentication credentials for artifactory.

Then when trying to pull an image I get the error unknown: Authentication is required

I've also tried to do a docker.login but got the same error

authenticate-docker:
  module.run:
    - name: docker.login
    - require:
      - file: /root/.docker/config.json

From the documentation I assume that Salt version 3000 should be able to authenticate docker using the config file instead of pillars.

When login to the machine I'm able to pull the image, I guess the user I'm using is correctly using the config file for authentication.

Expected behavior
Docker to use the credentials stored in /root/.docker/config.json

Versions Report
Salt 3000.3

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the authentication section of salt.modules.dockermod and the docker.login entry point, then reproduce the masterless Salt 3000.3 setup using /root/.docker/config.json. Check how the pull and login paths locate and consume that file; done means private-registry image pulls authenticate successfully without pillar registry credentials.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker, python
Domain
devops
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.