Skip to content

Use DOCKER_AUTH_CONFIG env as credential store - #6008

Merged
vvoland merged 1 commit into
docker:masterfrom
Benehiko:env-credentials-store
Jun 18, 2025
Merged

Use DOCKER_AUTH_CONFIG env as credential store#6008
vvoland merged 1 commit into
docker:masterfrom
Benehiko:env-credentials-store

Conversation

@Benehiko

@BenehikoBenehiko commented Apr 15, 2025

Copy link
Copy Markdown
Member

This patch enables the CLI to natively pick up the DOCKER_AUTH_CONFIG
environment variable and use it as a credential store.

The DOCKER_AUTH_CONFIG value should be a JSON object and must store
the credentials in a base64 encoded string under the auth key.

Credentials stored in DOCKER_AUTH_CONFIG would take precedence over any
credential stored in the file store (~/.docker/config.json) or native store
(credential helper).

Destructive actions, such as deleting a credential would result in a noop if
found in the environment credential. Credentials found in the file or
native store would get removed.

- What I did

- How I did it

- How to verify it

printf "username:pat" | openssl base64 -A

Setup the DOCKER_AUTH_CONFIG environment variable

DOCKER_AUTH_CONFIG='{
"auths": {"https://index.docker.io/v1/": {"auth": "aGk6KTpkY2tyX3BhdF9oZWxsbw=="}}}'
docker buildx bake --set binary.platform=linux/arm64docker run -it -v ./build/docker-linux-arm64:/bin/docker -v /var/run/docker.sock:/var/run/docker.sock --env DOCKER_AUTH_CONFIG alpine:latest /bin/ash/ # docker login...Login Succeeded

- Human readable description for the release notes

Use `DOCKER_AUTH_CONFIG` as a credential store

- A picture of a cute animal (not mandatory but encouraged)

@Benehiko
Benehiko requested a review from CopilotApril 15, 2025 05:37

CopilotAI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

@codecov-commenter

codecov-commenter commented Apr 15, 2025

Copy link
Copy Markdown

Codecov Report

Attention: Patch coverage is 71.42857% with 32 lines in your changes missing coverage. Please review.

Project coverage is 55.56%. Comparing base (9e50654) to head (9b83d5b).
Report is 24 commits behind head on master.

Additional details and impacted files
@@ Coverage Diff @@## master #6008 +/- ##
==========================================
+ Coverage 55.03% 55.56% +0.52% 
==========================================
Files 361 356 -5 Lines 30153 29999 -154 ==========================================
+ Hits 16596 16670 +74 + Misses 12599 12366 -233 - Partials 958 963 +5 
🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@Benehiko
Benehikoforce-pushed the env-credentials-store branch 2 times, most recently from 866c70a to eb43744CompareApril 15, 2025 06:27
@Benehiko
Benehiko requested review from a team and thaJeztahApril 15, 2025 06:27
@Benehiko
Benehiko marked this pull request as ready for review April 15, 2025 06:27
@BenehikoBenehiko mentioned this pull request Apr 15, 2025
4 tasks
Comment threadcli/config/credentials/env_store.go Outdated
Comment threadcli/config/credentials/env_store.go Outdated
Comment threadcli/config/credentials/env_store_test.go Outdated
Comment threadcli/config/configfile/file.go Outdated
@Benehiko
Benehikoforce-pushed the env-credentials-store branch from e7c6f4d to b3aa07fCompareMay 27, 2025 08:21
Comment threadcli/config/configfile/file.go Outdated
Comment threadcli/config/configfile/file.go Outdated
Comment threadcli/config/configfile/file.go Outdated
Comment threadcli/config/memory/store.go Outdated
Comment threadcli/config/memory/store.go Outdated
Comment threadcli/config/memory/store.go Outdated
@Benehiko
Benehikoforce-pushed the env-credentials-store branch from de90f77 to b7770d7CompareMay 27, 2025 12:36
@Benehiko
Benehiko requested a review from thaJeztahMay 27, 2025 13:02
Comment threadcli/config/memorystore/store.go Outdated
@Benehiko
Benehikoforce-pushed the env-credentials-store branch 2 times, most recently from d801989 to 0417f99CompareJune 3, 2025 08:19
@Benehiko
Benehiko requested a review from thaJeztahJune 3, 2025 08:45
Comment threadcli/config/configfile/file.go Outdated
Comment threadcli/config/configfile/file_test.go Outdated
Comment threadcli/config/configfile/file_test.go Outdated
Comment threadcli/config/configfile/file_test.go Outdated
Comment threadcli/config/configfile/file_test.go Outdated
Comment threadcli/config/memorystore/store.go Outdated
Comment threadcli/config/memorystore/store.go Outdated
Comment threadcli/config/memorystore/store.go
Comment threadcli/config/memorystore/store_test.go Outdated
@Benehiko
Benehikoforce-pushed the env-credentials-store branch 2 times, most recently from 5e95a08 to 63c990cCompareJune 6, 2025 11:15
@Benehiko
Benehiko requested a review from thaJeztahJune 6, 2025 11:35
Comment threadcli/config/configfile/file.go
Comment threadcli/config/configfile/file.go Outdated
Comment threadcli/config/configfile/file.go Outdated
Comment threadcli/config/configfile/file.go Outdated
Comment threadcli/config/configfile/file.go Outdated
Comment threadcli/config/configfile/file_test.go
@thaJeztah

Copy link
Copy Markdown
Member

@Benehiko
Benehikoforce-pushed the env-credentials-store branch 3 times, most recently from 4978971 to 2d0b124CompareJune 13, 2025 07:27
Comment threadcli/config/configfile/file.go Outdated
@Benehiko
Benehikoforce-pushed the env-credentials-store branch from 2d0b124 to 5f2a40aCompareJune 17, 2025 05:21
@Benehiko
Benehiko requested a review from thaJeztahJune 17, 2025 05:40
Comment threadcli/config/memorystore/store.go Outdated

@vvolandvvoland left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I noticed I had some pending comments

Comment threadcli/config/memorystore/store.go Outdated
Comment threadcli/config/configfile/file_test.go Outdated
@thaJeztahthaJeztah added this to the 28.3.0 milestone Jun 17, 2025
@Benehiko
Benehikoforce-pushed the env-credentials-store branch from 5f2a40a to bb1bf8cCompareJune 17, 2025 11:21

@thaJeztahthaJeztah left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@thaJeztah

Copy link
Copy Markdown
Member

@vvoland PTAL

@vvolandvvoland left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Overall looks good, but left some comments

Comment threadcli/config/memorystore/store_test.go Outdated
Comment threadcli/config/configfile/file.go Outdated
Comment threadcli/config/configfile/file.go Outdated
Comment threadcli/config/configfile/file_test.go Outdated
This patch enables the CLI to natively pick up the `DOCKER_AUTH_CONFIG`
environment variable and use it as a credential store.
The `DOCKER_AUTH_CONFIG` value should be a JSON object and must store
the credentials in a base64 encoded string under the `auth` key.
Specifying additional fields will cause the parser to fail.
For example:
`printf "username:pat" | openssl base64 -A`
`export DOCKER_AUTH_CONFIG='{
"auths": {
"https://index.docker.io/v1/": {
"auth": "aGk6KTpkY2tyX3BhdF9oZWxsbw=="
}
}
}'`
Credentials stored in `DOCKER_AUTH_CONFIG` would take precedence over any
credential stored in the file store (`~/.docker/config.json`) or native store
(credential helper).
Destructive actions, such as deleting a credential would result in a noop if
found in the environment credential. Credentials found in the file or
native store would get removed.
Signed-off-by: Alano Terblanche <18033717+Benehiko@users.noreply.github.com>
@Benehiko
Benehikoforce-pushed the env-credentials-store branch from bb1bf8c to 9b83d5bCompareJune 18, 2025 16:55
@Benehiko
Benehiko requested a review from vvolandJune 18, 2025 16:58

@vvolandvvoland left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, thanks!

Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants

@Benehiko@codecov-commenter@thaJeztah@vvoland