Parsing config.json for Auth on Mac OS with "credsStore": "osxkeychain" fails

[michaeldye]

I have a Docker config file in ~/.docker/config.json with this content:

{ "auths": { "mydomain.org": {} }, "credsStore": "osxkeychain" }

... I get an ErrCannotParseDockercfg returned from https://github.com/fsouza/go-dockerclient/blob/master/auth.go#L138 .

[fsouza]

@michaeldye hey, thanks for reporting this. We can fix the parsing issue, but right now go-dockerclient isn't integrated with osxkeychain and wouldn't be able to retrieve your credentials there.

I think that you could use docker's helpers to load the data from the keychain (https://github.com/docker/docker-credential-helpers/tree/master/osxkeychain), then construct AuthConfiguration from the data you get from the keychain.

Doing that in go-dockerclient would make go-dockerclient require CGO, which isn't really worth it. There could be a package that given a serverURL returns a go-dockerclient's AuthConfiguration, but that couldn't live inside go-dockerclient.

[coodix]

@fsouza hey, the workaround by manual adding auth base64 encoded string to config.json could be easy:
{ "auths": { "dockerio.badoo.com": {}, "localhost:5000": { "auth": "...base64encoded credentials..." } }, "credsStore": "osxkeychain" }
But another problem is that if any of auths doesn't have auth string then authConfigs function from auth.go fails with error "ErrCannotParseDockercfg". That makes impossible this workaround.

Do you consider returning error only if there are no one valid auth string in config file?

[fsouza]

Hey @coodix, thanks for the feedback. YEah, that makes sense. I'm gonna modify the code to behave as you suggested. Thank you very much!

[wuestkamp]

So I solved this on OSX by disabling the keychain password storage:

1. rm ~/.docker/config.json
2. in Docker for Mac preferences, untick "Securely store Docker logins in macOS keychain"
3. restart Docker for Mac
4. docker login

Or for glcoud and pushing to gcr:
gcloud auth print-access-token | docker login -u oauth2accesstoken --password-stdin https://eu.gcr.io

now your ~/.docker/config.json should contain base64 encoded passwords. Working, not safe though!

If someone gets the keychain storage to work that would be nice...