Skip to content

Fix authentication towards HTTP docker registries

What does this MR do?

Fix authentication towards HTTP docker registries

Why was this MR needed?

c10ef215 (!4727 (merged)) introduced a regression: if the docker auth configuration contains explicitly HTTP registries, they will fail to be parsed correctly by the runner.

For example, given the following docker auth config:

{
    "auths": {
        "docker.example.com": {
            "auth": "..."
        },
        "http://docker-registry.example.com": {
            "auth": "..."
        }
    }
}

gitlab-runner parses the following (from debug log output):

Loaded Docker credentials, source = "/root/.docker/config.json", hostnames = [docker.example.com http://docker-registry.example.com], error = <nil>

Which results in the image pull failing because the credentials can't be matched later:

builds=0 error=failed to pull image "docker-registry.example.com/a/b:latest" with specified policies [always]: Error response from daemon: Head "https://docker-registry.example.com/v2/a/b/manifests/latest": no basic auth credentials (manager.go:254:0s) executor=docker

Adding the same entry as HTTPS (or as a host with no scheme) to the docker auth fixes the job, but that's not always an option (and is still a regression anyway).

What's the best way to test this MR?

I think the unit tests themselves should be enough? Otherwise the steps described above should can help, please tell me if a full procedure would be preferred.

What are the relevant issue numbers?

I did not find any issue matching this, but I may not have looked for the right keywords.

Edited by 🤖 GitLab Bot 🤖

Merge request reports

Loading