I need plain text credentials in my config.json, how do I disable this if it is enabled? #95

red8888 · 2017-10-29T17:44:25Z

On windows it defaults to using this provider so when I run docker login sensitive info isn't saved to the config.json. This is good but I need to disable it, I need these creds to be plain text to support a specific service.

This is very frustrating because I can't find any info on how to disable wincred (or even uninstall it). There has to be a way to turn it off temporarily so I can generate a config.json with my creds in plain text.

vdemeester · 2017-10-29T18:44:07Z

@red8888 Reading https://docs.docker.com/engine/reference/commandline/login/#credentials-store I think explicitely putting an empty value in the credsStore value in ~/.docker/config.json instead of wincred should do the trick 👼

tahonaPL · 2018-11-02T13:14:11Z

Not working, docker login put wincred in empty place.

cmorty · 2019-05-02T13:48:00Z

This does not work for Windows Docker Enterprise 18.09.5

ijc · 2019-05-02T13:54:56Z

I don't know how one would translate this into a Windows equivalent but LinuxKit calls the credhelper itself to extract the values: https://github.com/linuxkit/linuxkit/blob/master/scripts/push-manifest.sh#L52...L54

If you could replicate that on Windows (In powershell perhaps?) then you could write your own config.json in some tempdir and point your service at that instead of the real one perhaps?

cmorty · 2019-05-02T14:41:58Z

Ok, seems like manually copying wincred into the docker installation folder fixes things. 18.09.2 worked just fine.

dpalinic · 2019-05-24T14:23:34Z

Hello guys. I'm having the same issue on ubuntu 18. In credStore there's pass configured and no matter what I do, I can't disable it.

If I remove pass value from credStore and try to docker login I get error that pass is not initialized
If I delete .docker/config.json, I got same as 1.

Is there a way to disable this? I want my plain text back again.

Thanks

DouglasHeriot · 2019-10-18T04:34:48Z

Also keen to get plain text only credentials. I'm connecting to AWS ECR so the credentials are only valid for a few hours anyway.

verglor · 2019-12-20T03:17:21Z

If you have WSL enabled you can use wsl docker --config . login to store plain text config.json in current directory.

jimtang2 · 2020-01-22T01:57:49Z

I just got the auth hash after setting the credsStore value to "" followed by docker login.

pleonex · 2020-06-09T17:58:53Z

The workaround is not working anymore. In the latest version for us Docker is overwriting the value and using wincred again. It has broken our build and release pipelines. There are also many people reporting that in the for-mac repo and as always, so far no reply from Docker guys...

Linked issues (probably way more, especially closed by our hated Docker bot):

We need an actual value that tells Docker to not use any external credential, just base64 as before. We don't need workarounds of "set it to empty", "remove it from the file" or "delete the binaries from the Docker installation" because after each update the behavior of that "empty / not present" value changes.

It's ok to break things. We are software developers, we do it all the time. But please, just reply to any of the issues. Listen the community, we are taking our work time to investigate and report them. Try to help and stop auto-closing issues because no one from the dev team replied. After reading all of these unanswered issues I am feeling no one cares about the issues we report.

pleonex · 2020-06-10T10:43:14Z

The issue could be here:

https://github.com/docker/cli/blob/b350e14b1f83e1870a234ff2c554450707218204/cli/config/config.go#L143-L144

That it's getting the default storage when the value from the configuration file is empty. The default storage is the one from the platform even when the user specifies empty.

https://github.com/docker/cli/blob/b350e14b1f83e1870a234ff2c554450707218204/cli/config/credentials/default_store.go#L9-L21

and here it creates the "native" credential store instead of the "file" one as we want:

https://github.com/docker/cli/blob/f7185d27e165c50c55c898720fec38b37a751393/cli/config/configfile/file.go#L280

but according to these function, if we set the credHelpers of our repository to empty, it will use the "file" store

https://github.com/docker/cli/blob/f7185d27e165c50c55c898720fec38b37a751393/cli/config/configfile/file.go#L280

~~I have tested that workaround and now it works again!~~ Update: it doesn't work Let's see for how much time since this doesn't seem to be well supported. New config file:

{
	"auths": {},
	"HttpHeaders": {
		"User-Agent": "Docker-Client/19.03.8 (windows)"
	},
	"credsStore": "wincred",
	"credHelpers": {
		"MY_PRIVATE_REPOSITORY_URL": ""
	}
}

pleonex · 2020-06-16T13:32:35Z

The workaround doesn't fully work as Docker decides to wipe out my config file and remove all the credHelpers. I have to create scripts to re-create this config file every time we do a docker push.

We are starting to consider migrating to Podman and Buildah, it's just incredible that we don't get any answer for these bugs reported for several years, with workarounds that need to be changed and investigated in every Docker update....

Kabal163 · 2020-07-07T14:54:37Z

Docker team, any updates? I have the same problem and no workarounds work...

Cheaterman · 2020-11-12T13:32:01Z

That's fairly annoying, to be honest. I feel like it's pretty standard to have your CD runner log into your docker registry while headless, and that would fail if target machine has gnome-keyring (rather docker-credential-secretservice) installed. Installing docker-credential-pass is somewhat of a solution in my situation though, unlike OP.

alexanderilyin · 2021-03-18T06:44:28Z

My Workaround

Hiding docker-credential-pass from which / PATH and using separate config for example $PWD/.docker/config.json is required to make both Base64 and pass to work on same host for same user, you will just have to run different commands for each method.

Do not put docker-credential-pass. Put it to $PWD/bin/docker-credential-pass and update $PATH before calling any docker command, for example:
```
PATH=$PWD/bin/docker-credential-pass:$PATH docker login ...
```

Use custom config.json to store desired credsStore state, for example:

PATH=$PWD/bin/docker-credential-pass:$PATH docker login --config $PWD/.docker/ ...

Base64

docker login ...
# Reading $HOME/.docker/config.json

`pass`

Note that --config accepts directory and NOT a filename.

PATH=$PWD/bin/docker-credential-pass:$PATH docker login --config $PWD/.docker/ ...
# Reading $PWD/.docker/config.json

bennahugo · 2021-11-21T18:24:23Z

apt remove golang-docker-credential-helpers worked for me

This uninstalls
The following packages will be REMOVED:
docker-compose golang-docker-credential-helpers python-docker python-dockerpycreds

This means I cannot use docker-compose, but I would rather start my containers with a normal shell script than it popping up GUI based key managers all the time

Running: ubuntu 18.04

$ docker --version
Docker version 20.10.7, build 20.10.7-0ubuntu5~18.04.3

tiejunhu · 2022-02-25T06:23:57Z

Just encountered this issue on Mac/Monterey with latest Docker desktop 4.5.0(74594). The workaround is:

remove all docker-credential-* from /Applications/Docker.app/Contents/Resources/bin/
remove credsStore and auth key from ~/.docker/config.json
do docker login, if you get this warning, you are good to go:

[2022-02-25 14:18:33] WARNING! Your password will be stored unencrypted in xxx/.docker/config.json.
[2022-02-25 14:18:33] Configure a credential helper to remove this warning. See
[2022-02-25 14:18:33] https://docs.docker.com/engine/reference/commandline/login/#credentials-store

henriquevcosta · 2022-11-15T05:30:08Z

Just encountered this issue on Mac/Monterey with latest Docker desktop 4.5.0(74594). The workaround is:

1. remove all docker-credential-* from /Applications/Docker.app/Contents/Resources/bin/

2. remove credsStore and auth key from ~/.docker/config.json

3. do docker login, if you get this warning, you are good to go:

[2022-02-25 14:18:33] WARNING! Your password will be stored unencrypted in xxx/.docker/config.json.
[2022-02-25 14:18:33] Configure a credential helper to remove this warning. See
[2022-02-25 14:18:33] https://docs.docker.com/engine/reference/commandline/login/#credentials-store

I tried just temporarily moving them to a new name (they were actually symlinks in /usr/local/bin, renamed the symlinks) and renaming them back after logging in and so far so good.

ccsalway · 2023-02-27T21:26:05Z

Here's the solution I came up with - a python script that handles the store, get commands

docker-credential-plaintext.py

#!/usr/bin/env python3

import json
import os
import sys

_data = None
_args = sys.argv  # action
_stdin = sys.stdin.read().strip()
_dir = os.environ['DOCKER_CONFIG']
creds_file = f'{_dir}/creds.json'

if os.path.isfile(creds_file):
    with open(creds_file, 'r') as f:
        _data = f.read()

creds = json.loads(_data) if _data else {}

if _args[1] == 'store':
    input = json.loads(_stdin)  # ServerURL,Username,Secret:dict
    creds[input['ServerURL']] = {
        "Username": input['Username'],
        "Secret": input['Secret']
    }
    with open(creds_file, 'w') as f:
        json.dump(creds, f, indent=2)

elif _args[1] == 'get':
    input = _stdin  # ServerURL:str
    if input in creds:
        print(json.dumps(creds[input]))

Example usage:

cp -f docker-credential-plaintext.py /usr/local/bin/docker-credential-plaintext
chmod +x /usr/local/bin/docker-credential-plaintext

export DOCKER_CONFIG="$(pwd)/.docker"
mkdir -p "$DOCKER_CONFIG"
echo '{"credsStore": "plaintext"}' > "$DOCKER_CONFIG/config.json"

docker --config "$DOCKER_CONFIG" login --username USERNAME --password PASSWORD REPOSITORY
docker push REPOSITORY/IMAGE:TAG

stefanloerwald mentioned this issue Dec 17, 2020

docker always restores credStore desktop docker/for-win#9843

Closed

MichaelJCole mentioned this issue Dec 10, 2022

Document how to initialize docker-credentials-pass #102

Open

Codym48 mentioned this issue Mar 13, 2023

How do I pass docker credentials in to a container? #183

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

I need plain text credentials in my config.json, how do I disable this if it is enabled? #95

I need plain text credentials in my config.json, how do I disable this if it is enabled? #95

red8888 commented Oct 29, 2017

vdemeester commented Oct 29, 2017

tahonaPL commented Nov 2, 2018

cmorty commented May 2, 2019

ijc commented May 2, 2019

cmorty commented May 2, 2019

dpalinic commented May 24, 2019

DouglasHeriot commented Oct 18, 2019

verglor commented Dec 20, 2019

jimtang2 commented Jan 22, 2020

pleonex commented Jun 9, 2020 •

edited

Loading

pleonex commented Jun 10, 2020 •

edited

Loading

pleonex commented Jun 16, 2020

Kabal163 commented Jul 7, 2020

Cheaterman commented Nov 12, 2020 •

edited

Loading

alexanderilyin commented Mar 18, 2021 •

edited

Loading

bennahugo commented Nov 21, 2021 •

edited

Loading

tiejunhu commented Feb 25, 2022

henriquevcosta commented Nov 15, 2022

ccsalway commented Feb 27, 2023 •

edited

Loading

I need plain text credentials in my config.json, how do I disable this if it is enabled? #95

I need plain text credentials in my config.json, how do I disable this if it is enabled? #95

Comments

red8888 commented Oct 29, 2017

vdemeester commented Oct 29, 2017

tahonaPL commented Nov 2, 2018

cmorty commented May 2, 2019

ijc commented May 2, 2019

cmorty commented May 2, 2019

dpalinic commented May 24, 2019

DouglasHeriot commented Oct 18, 2019

verglor commented Dec 20, 2019

jimtang2 commented Jan 22, 2020

pleonex commented Jun 9, 2020 • edited Loading

pleonex commented Jun 10, 2020 • edited Loading

pleonex commented Jun 16, 2020

Kabal163 commented Jul 7, 2020

Cheaterman commented Nov 12, 2020 • edited Loading

alexanderilyin commented Mar 18, 2021 • edited Loading

My Workaround

Base64

pass

bennahugo commented Nov 21, 2021 • edited Loading

tiejunhu commented Feb 25, 2022

henriquevcosta commented Nov 15, 2022

ccsalway commented Feb 27, 2023 • edited Loading

pleonex commented Jun 9, 2020 •

edited

Loading

pleonex commented Jun 10, 2020 •

edited

Loading

Cheaterman commented Nov 12, 2020 •

edited

Loading

alexanderilyin commented Mar 18, 2021 •

edited

Loading

`pass`

bennahugo commented Nov 21, 2021 •

edited

Loading

ccsalway commented Feb 27, 2023 •

edited

Loading