Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Appearance settings

Share CLI credentials over a unix socket #5948

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
wants to merge 1 commit into
base: master
Choose a base branch
Loading
from

Conversation

Benehiko
Copy link
Member

@Benehiko Benehiko commented Mar 21, 2025

This PR is a proof of concept to share docker credentials from the CLI.
Related to #5858

What is the benefit of this?

  • Keep the credentials in sync (OAuth credentials refresh - currently in CLI they do not, but DD does)
  • Single source of truth
  • No need to worry about if the credentials are stored in the config or inside the credential helper, the CLI already has mechanisms to detect it for you.
./build/docker-darwin-arm64 auth credential-server
Starting credential server...
curl http://localhost/credentials --unix-socket ~/.docker/run/docker_cli_credential_server.sock

- What I did
Created a command called auth which is a manager for the CLI credentials. This allows us to expose the credentials that the CLI have access to (config, credential helper etc.).

docker auth credential-server

This will create a new unix socket inside the default docker config directory ~/.docker/run/docker_cli_credential_server.sock. Using this socket you can retrieve the credentials, save credentials back and delete credentials.

The CLI has a built in mechanism that would detect the docker_cli_credential_server.sock and implements the credentials.Store interface so that any calls to the socket would correctly return types.AuthConfig as normal. This means that the socket iteslf becomes a credential store.

This also solves situatations where the docker CLI need credentials when run inside of a docker container.

docker buildx bake --set binary.platform=linux/arm64
docker run -it -v ./build/docker-linux-arm64:/bin/docker -v /Users/benehiko/.docker/run/docker_cli_credential_server.sock:/root/.docker/run/docker_cli_credential_server.sock -v /var/run/docker.sock:/var/run/docker.sock alpine:latest /bin/ash
/ # docker login
Authenticating with existing credentials... [Username: <your username>]

i Info → To login with a different account, run 'docker logout' followed by 'docker login'

Login Succeeded

- How I did it

- How to verify it

- Human readable description for the release notes

- A picture of a cute animal (not mandatory but encouraged)

@codecov-commenter
Copy link

codecov-commenter commented Mar 21, 2025

Codecov Report

Attention: Patch coverage is 10.46512% with 154 lines in your changes missing coverage. Please review.

Project coverage is 59.19%. Comparing base (48741f7) to head (653818b).
Report is 11 commits behind head on master.

Additional details and impacted files
@@            Coverage Diff             @@
##           master    #5948      +/-   ##
==========================================
- Coverage   59.42%   59.19%   -0.24%     
==========================================
  Files         358      360       +2     
  Lines       29768    29916     +148     
==========================================
+ Hits        17690    17708      +18     
- Misses      11113    11240     +127     
- Partials      965      968       +3     
🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Signed-off-by: Alano Terblanche <18033717+Benehiko@users.noreply.github.com>
@Benehiko Benehiko force-pushed the credential-server branch from d604e96 to 653818b Compare March 21, 2025 14:59
D3-LucaPiombino added a commit to CodeCoil/container-desktop that referenced this pull request Jun 2, 2025
…uildx: `0.24.0`) (#10)

## Summary of the Pull Request
Update docker (and related tooling) to the latest version.

## Detailed Description of the Pull Request / Additional comments

The core motivation is to have a version of the docker client that does
not attempt to mutate/rewrite the config
(docker/cli#5553).

This is in preparation of a future enhancement to share the same client
configuration of the windows host and to provide a seamless experience.
This could include also the auth via credential helpers running on the
host (e.g. a basic scenario is to at least use the windows credential
manager to avoid storing static credentials in plain in the config
file).

I did not push anything yet because i am waiting to see if
docker/cli#5948
get merged as it would probably provide a better and simpler out of the 
box experience.

Co-authored-by: Luca Piombino <luca.piombino@codecoil.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants
Morty Proxy This is a proxified and sanitized view of the page, visit original site.