Login credentials are case-senstive

[hswimelar]

Description

For images which require authorization, the host passed to the docker login command must match the host in the image in a case-sensitive manner. Reported to us at GitLab originally here: https://gitlab.com/gitlab-org/gitlab/-/issues/255291

Steps to reproduce the issue:
Assuming a registry running and reachable at test.registry.org

1. docker build -t Test.Registry.org/test:latest .
2. docker login test.registry.org
3. docker push Test.Registry.org/test:latest auth fails

Describe the results you received:

Authentication fails.

Describe the results you expected:

Authentication does not fail.

Additional information you deem important (e.g. issue happens only occasionally):

The client is caching the login credentials in a case-sensitive manner

09:04 $ cat ~/.docker/config.json
{
 "auths": {
 "Test.Registry.org": {
 "auth": "super-secret"
 },
 "test.registry.org": {
 "auth": "super-secret"
 }
 },
 "HttpHeaders": {
 "User-Agent": "Docker-Client/19.03.13 (linux)"
 },
 "experimental": "enabled"
}

Output of docker version:

09:56 $ docker version
Client: Docker Engine - Community
 Version: 19.03.13
 API version: 1.40
 Go version: go1.13.15
 Git commit: 4484c46d9d
 Built: Wed Sep 16 17:02:36 2020
 OS/Arch: linux/amd64
 Experimental: true

Server: Docker Engine - Community
 Engine:
 Version: 19.03.13
 API version: 1.40 (minimum version 1.12)
 Go version: go1.13.15
 Git commit: 4484c46d9d
 Built: Wed Sep 16 17:01:06 2020
 OS/Arch: linux/amd64
 Experimental: false
 containerd:
 Version: 1.3.7
 GitCommit: 8fba4e9a7d01810a393d5d25a3621dc101981175
 runc:
 Version: 1.0.0-rc10
 GitCommit: dc9208a3303feef5b3839f4323d9beb36df0a9dd
 docker-init:
 Version: 0.18.0

Output of docker info:

Client:
 Debug Mode: false
 Plugins:
 app: Docker Application (Docker Inc., v0.8.0)
 buildx: Build with BuildKit (Docker Inc., v0.4.2-tp-docker)

Server:
 Containers: 6
 Running: 0
 Paused: 0
 Stopped: 6
 Images: 71
 Server Version: 19.03.13
 Storage Driver: overlay2
 Backing Filesystem: extfs
 Supports d_type: true
 Native Overlay Diff: true
 Logging Driver: json-file
 Cgroup Driver: cgroupfs
 Plugins:
 Volume: local
 Network: bridge host ipvlan macvlan null overlay
 Log: awslogs fluentd gcplogs gelf journald json-file local logentries splunk syslog
 Swarm: inactive
 Runtimes: runc
 Default Runtime: runc
 Init Binary: docker-init
 containerd version: 8fba4e9a7d01810a393d5d25a3621dc101981175
 runc version: dc9208a3303feef5b3839f4323d9beb36df0a9dd
 init version: fec3683
 Security Options:
 apparmor
 seccomp
 Profile: default
 Kernel Version: 5.4.0-48-generic
 Operating System: Ubuntu 18.04.5 LTS
 OSType: linux
 Architecture: x86_64
 CPUs: 16
 Total Memory: 30.99GiB
 Name: hayley-Precision-5540
 ID: CI4P:CT65:VU5N:4VFX:BHYO:ABRF:HDYL:EXN7:KFDA:QHO6:OY6V:WV7U
 Docker Root Dir: /var/lib/docker
 Debug Mode: false
 Registry: https://index.docker.io/v1/
 Labels:
 Experimental: false
 Insecure Registries:
 gitlab.local:5000
 127.0.0.0/8
 Live Restore Enabled: false

WARNING: No swap limit support

Additional environment details (AWS, VirtualBox, physical, etc.):

10:00 $ uname -a
Linux hayley-Precision-5540 5.4.0-48-generic #52~18.04.1-Ubuntu SMP Thu Sep 10 12:50:22 UTC 2020 x86_64 x86_64 x86_64 GNU/Linux

[thaJeztah]

Thanks for reporting! Yes, I think we should improve this handling.

When implementing, we need to tread carefully in this area somewhat, as the credentials should be stored case-insensitive, but there's also the image tags that are using case-sensitivity (need to check the spec on what it describes there)

for example;

docker tag busybox Test.Registry.org/test:latest
docker tag busybox test.registry.org/test:latest

docker image ls --filter 'reference=*.org/*'
REPOSITORY TAG IMAGE ID CREATED SIZE
Test.Registry.org/test latest 018c9d7b792b 2 months ago 1.22MB
test.registry.org/test latest 018c9d7b792b 2 months ago 1.22MB

[piotrowski]

Hi @thaJeztah Here is a PR: #2782

However I did find smth strange (I am not sure if it is a bug or not):

1. Push LOCALhost:5000/exampleImage
2. login to localhost:5000
3. Pull localhost:5000/exampleImage
4. Image was pulled

I tested it on normal (without my fix) version and it was working like this too, I did not push localhost:5000/exampleImage to the repository