Skip to content

[api, builder] Fix build auth config#14139

Merged
tiborvass merged 1 commit intomoby:masterfrom
jlhawn:fix_build_with_auth
Jun 26, 2015
Merged

[api, builder] Fix build auth config#14139
tiborvass merged 1 commit intomoby:masterfrom
jlhawn:fix_build_with_auth

Conversation

@jlhawn
Copy link
Copy Markdown
Contributor

@jlhawn jlhawn commented Jun 23, 2015

With the 1.7 release, we introduced a change to how we store registry
credentials, but the build API endpoint did not expect a change in the format
of that file. This patch fixes this problem so that you can again pull private
images during docker build.

fixes #14065
fixes #14092
fixes #14057

With the 1.7 release, we introduced a change to how we store registry
credentials, but the build API endpoint did not expect a change in the format
of that file. This patch fixes this problem so that you can again pull private
images during `docker build`.

Docker-DCO-1.1-Signed-off-by: Josh Hawn <[email protected]> (github: jlhawn)
@jlhawn
Copy link
Copy Markdown
Contributor Author

jlhawn commented Jun 23, 2015

This is really difficult to add to our automated tests because it requires a private repository and for us to either set that situation up during the tests OR include credentials in the integration-cli code.

@jlhawn
Copy link
Copy Markdown
Contributor Author

jlhawn commented Jun 23, 2015

ping @dmp42 I think this should fix your issue.

@dmp42 dmp42 added this to the 1.7.1 milestone Jun 23, 2015
@dmp42
Copy link
Copy Markdown
Contributor

dmp42 commented Jun 23, 2015

ping @stevvooe @RichardScothern @dmcgowan
also ping @icecrime

@stevvooe
Copy link
Copy Markdown
Contributor

@jlhawn What change broke this?

@jlhawn
Copy link
Copy Markdown
Contributor Author

jlhawn commented Jun 25, 2015

@stevvooe I think it' was @duglin's changes in #12009

@LK4D4
Copy link
Copy Markdown
Contributor

LK4D4 commented Jun 25, 2015

LGTM

@duglin
Copy link
Copy Markdown
Contributor

duglin commented Jun 25, 2015

@jlhawn just to make sure I fully understand what happened... in #12009 we moved the auth stuff in the config file down one level and so when we serialized that info there was now an extra wrapper around the auth stuff. Your fix, pretty much, removes the extra wrapper (so now its just a map) like we used to encode in the header before the other PR. Right?

@tiborvass
Copy link
Copy Markdown
Contributor

@jlhawn I could reproduce the issue, and your PR indeed fixes it, not only on top of master but also cherry-picked on top of 1.7.0

@tiborvass
Copy link
Copy Markdown
Contributor

I'll LGTM this because it makes sense to me, but I wanna make sure @duglin is also okay with this fix before merging :)

@jlhawn
Copy link
Copy Markdown
Contributor Author

jlhawn commented Jun 25, 2015

@duglin yep, that's correct.

@duglin
Copy link
Copy Markdown
Contributor

duglin commented Jun 26, 2015

LGTM - too bad we can't write a testcase :-(

tiborvass added a commit that referenced this pull request Jun 26, 2015
[api, builder] Fix build auth config
@tiborvass tiborvass merged commit dd40889 into moby:master Jun 26, 2015
@tiborvass
Copy link
Copy Markdown
Contributor

Thanks guys

@calavera calavera self-assigned this Jun 29, 2015
@calavera
Copy link
Copy Markdown
Contributor

cherry picked into 1.7.1

@aanand
Copy link
Copy Markdown
Contributor

aanand commented Jul 21, 2015

Does this change affect all API versions? Can a client using API version 1.18 still send an old-style X-Registry-Auth header? I ask because users of Compose (which uses 1.18) and docker-py are experiencing issues due to this and we'd like to fix it.

It's easy enough to update Compose to use API version 1.19 and require Docker 1.7 or later, but docker-py supports older API versions and it's important that they remain stable.

@jlhawn
Copy link
Copy Markdown
Contributor Author

jlhawn commented Jul 21, 2015

@aanand I believe this change reverted the change in 1.7 where the /build endpoint expected the new ~/.docker/config file format:

{
    "auths": {
        "https://index.docker.io/v1/": {
            "auth": "dXNlcm5hbWU6cGFzc3dvcmQ=",
            "email": "[email protected]"
        }
    }
}

This patch goes back to using the original format of ~/.dockercfg:

{
    "https://index.docker.io/v1/": {
        "auth": "dXNlcm5hbWU6cGFzc3dvcmQ=",
        "email": "[email protected]"
    }
}

@MrMMorris
Copy link
Copy Markdown

is this not fixed yet? I am running 1.7.1 and still getting image not found from private repo

@jlhawn
Copy link
Copy Markdown
Contributor Author

jlhawn commented Jul 27, 2015

@MrMMorris This was included in Docker 1.7.1 (both your Docker client and daemon should be updated).

If you're having an issue with a private repository on the Docker Hub Registry, then I would recommend contacting their support folks. If you're running a private Registry from https://github.com/docker/distribution then I'd try opening an issue there or checking their IRC channel (#docker-distribution on irc.freenode.net).

@MrMMorris
Copy link
Copy Markdown

@jlhawn yep, I was definitely running an old version of client (1.4.1), but after brew update && brew upgrade docker, I still get image company/blah:latest not found.

$ docker -v
Docker version 1.7.1, build 786b29d

This is pulling from Docker Hub using docker-compose up

@jlhawn
Copy link
Copy Markdown
Contributor Author

jlhawn commented Jul 27, 2015

oh, okay, then I guess that would be what @aanand was mentioning above (he's a maintainer of docker-compose which uses docker-py).

@MrMMorris if you do a manual pull using docker pull company/blah:latest does that also fail? and did you remember to do a docker login first?

@jlhawn
Copy link
Copy Markdown
Contributor Author

jlhawn commented Jul 27, 2015

@aanand are docker-compose and docker-py aware that the config file has been moved from ~/.dockercfg to ~/.docker/config.json?

@jlhawn
Copy link
Copy Markdown
Contributor Author

jlhawn commented Jul 27, 2015

I think you can also use an environment variable now to specify the location of the config directory.

@MrMMorris
Copy link
Copy Markdown

@jlhawn I am definitely logged in. Manual pull works as does the workaround detailed in the ticket referenced below.

I think @aanand is aware. This is the ticket that eventually lead me here: docker/compose#1577. I guess something still has to be done on the compose side?

@aanand
Copy link
Copy Markdown
Contributor

aanand commented Jul 28, 2015

@MrMMorris What version of Compose are you using? The fix for not reading ~/.docker/config.json was released in 1.3.2.

@MrMMorris
Copy link
Copy Markdown

@aanand hello again 😄

As in the other ticket, I am running 1.4.0rc2.

@marcust
Copy link
Copy Markdown

marcust commented Jul 31, 2015

Hey, I initially reported #14092 which is supposedly fixed in 1.7.1. But it actually doesn't work for my usecase (through the docker-java client) and now I'm slightly confused. Is there a change needed in the actual client for the build endpoint?

@jlhawn jlhawn deleted the fix_build_with_auth branch July 31, 2015 18:02
@rashtisouciance
Copy link
Copy Markdown

Hi,

Just wanted to say that we are also experiencing this issue. If you do a docker login, then pull the image from the private repo on dockerhub that works fine. If you do a docker build from a dockerfile which has a FROM then it reports that the image is not found. Our docker on that machine is running on Docker version 1.9.1, build a34a1d5/1.9.1

@stevvooe
Copy link
Copy Markdown
Contributor

@rashtisouciance This PR was merged over a year ago, so I am not sure that this is the same issue. I'd recommend hitting the support forums or filing a second issue if you are looking to find a solution.

In the future, I'd recommend not commenting on closed or merged PRs. Often times, issues with similar behavior can have completely different root causes, especially if the behavior is encountered after a large period of time (you are running 1.9.1 and this was fixed in 1.7.1).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet