testcontainers / testcontainers/testcontainers-go

[Bug]: When only using `credsStore` auth isn't used for any registry

Open
#3,602 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
Go
Stars
5k
Forks
637
Avg merge
2d 12h
Merged PRs (30d)
26

Description

Testcontainers version

0.40 and 0.41

Using the latest Testcontainers version?

Yes

Host OS

Linux, MacOS

Host arch

x86, ARM

Go version

1.26

Docker version

All of them would be a lot (CI/CD-- all 29.*) but here's dev machine stuff:

 Version:           29.2.1
 API version:       1.53
 Go version:        go1.25.6
 Git commit:        a5c7197d72
 Built:             Mon Feb  2 16:33:58 2026
 OS/Arch:           darwin/arm64
 Context:           default
Docker info
Client: Docker Engine - Community
 Version:    29.2.1
 Context:    default
 Debug Mode: false
 Plugins:
  buildx: Docker Buildx (Docker Inc.)
    Version:  v0.31.1
    Path:     /<redacted>/.docker/cli-plugins/docker-buildx
  compose: Docker Compose (Docker Inc.)
    Version:  5.0.2
    Path:     /<redacted>/.docker/cli-plugins/docker-compose

Server:
 Containers: 32
  Running: 19
  Paused: 0
  Stopped: 13
 Images: 21
 Server Version: 29.2.0
 Storage Driver: overlayfs
  driver-type: io.containerd.snapshotter.v1
 Logging Driver: json-file
 Cgroup Driver: cgroupfs
 Cgroup Version: 2
 Plugins:
  Volume: local
  Network: bridge host ipvlan macvlan null overlay
  Log: awslogs fluentd gcplogs gelf journald json-file local splunk syslog
 CDI spec directories:
  /etc/cdi
  /var/run/cdi
 Swarm: inactive
 Runtimes: io.containerd.runc.v2 runc
 Default Runtime: runc
 Init Binary: docker-init
 containerd version: dea7da592f5d1d2b7755e3a161be07f43fad8f75
 runc version: v1.3.4-0-gd6d73eb8
 init version: de40ad0
 Security Options:
  apparmor
  seccomp
   Profile: builtin
  cgroupns
 Kernel Version: 6.8.0-90-generic
 Operating System: Ubuntu 24.04.3 LTS
 OSType: linux
 Architecture: aarch64
 CPUs: 4
 Total Memory: 7.737GiB
 Name: colima
 ID: <redacted>
 Docker Root Dir: /var/lib/docker
 Debug Mode: false
 Experimental: false
 Insecure Registries:
  ::1/128
  127.0.0.0/8
 Live Restore Enabled: false
 Firewall Backend: iptables
What happened?

When only using (no auths, credshelpers, etc)

{
  "credsStore": "ecr-login"
}

(use credsStore for all registries)

testcontainers-go doesn't auth any registry.

Relevant log output
Error:      	Received unexpected error:
        	            	run postgres: generic container: create container: Error response from daemon: Head "<redacted>": no basic auth credentials
Additional information

Not requiring authentication for the registry, everything works. We discovered this when moving to a proxied image cache. We're doing this for a slew of languages and frameworks using testcontainers. Go is the only one where we've had an issue.

It also looks like in https://github.com/testcontainers/testcontainers-go/issues/1078 the decision was made to always check credsHelpers, but this is incorrect now. credsStore should be enough to configure all registries.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Reproduce the failure with a Docker config containing only "credsStore": "ecr-login", then trace how testcontainers-go loads registry credentials before pulling an image. Done means credentials from the global credential store are used for registry authentication and a regression test covers this configuration.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker, go
Domain
authentication, testing-qa
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.