Problem with `docker push`, using LDAP

[hooger]

Hello all, I'm trying to use the docker container to have a docker repository with LDAP authentication. The following docker-compose.yml starts the process:

version: "2.3"
services:
 registry:
  image: registry:2
  ports:
    - "443:5000"
  volumes:
    - ./ssl:/ssl
    - ./data:/data
  restart: always
  environment:
    - REGISTRY_STORAGE_DELETE_ENABLED=true
    - REGISTRY_STORAGE_FILESYSTEM_ROOTDIRECTORY=/data
    - REGISTRY_AUTH=token
    - REGISTRY_AUTH_TOKEN_REALM=<URL>:5001/auth
    - REGISTRY_AUTH_TOKEN_SERVICE="Docker registry"
    - REGISTRY_AUTH_TOKEN_ISSUER="Auth Service"
    - REGISTRY_AUTH_TOKEN_ROOTCERTBUNDLE=/ssl/fullchain.pem
    - REGISTRY_HTTP_TLS_CERTIFICATE=/ssl/fullchain.pem
    - REGISTRY_HTTP_TLS_KEY=/ssl/privkey.pem
    - REGISTRY_HTTP_SECRET=<SECRET_TOKEN>
 dockerauth:
   image: cesanta/docker_auth
   ports:
     - "5001:5001"
   volumes:
     - ./:/config:ro
     - ./ssl:/ssl
     - ./extensions:/extensions
   command: -alsologtostderr=true --v=2 -log_dir=/logs /config/extAuth.yml
   restart: always

docker login <URL> works, and I see it in the logs too, however when I try to push a local image, it fails with the log at the end of the issue. The command I use to login, tag the image and push are the following (URLs are removed):

docker login <URL>
docker pull postgres:11.5-alpine
docker image tag postgres:11.5-alpine <URL>/postgres
docker image push  <URL>/postgres
# this is the output of the last command
Using default tag: latest
The push refers to repository [<URL>/postgres]
07f8716644d1: Retrying in 3 seconds 
14c8688fc010: Retrying in 10 seconds 
f391c07215f8: Retrying in 6 seconds 
160b4a51c493: Retrying in 5 seconds 
19af83901c67: Retrying in 8 seconds 
69d72b342688: Waiting 
db3a903780ba: Waiting 
766d031fa954: Waiting 
77cae8ab23bf: Waiting 
^C

I have seen that there are some issues with the string invalid memory address or nil pointer dereference, however from the answers I got the feeling, that these issues are solved with the latest image. I also tried to increase the memory of the VM from 512MB to 1024MB, but it also does not help. What can be the problem? In case you need any more logs, or configurations I gladly send them, unfortunatelly I had to remove some sensitive data however, that may help the identification of the LDAP server. :(

Thanks in advance!

That is the server side log, at the end, as this was huge. I had to remove some repeating msgs because of GH character limit.

Stopping Docker auth server...
 conf_dockerauth_1 exited with code 137
conf_dockerauth_1
Error response from daemon: Cannot kill container: conf_dockerauth_1: Container b62dec3a2c39340a65064109605573dab686d1c0737209bff7ce79ad28501f04 is not running
conf_dockerauth_1
 conf_registry_1 exited with code 137
conf_registry_1
 Gracefully stopping... (press Ctrl+C again to force)
docker_auth.service: Succeeded.
Stopped Docker auth server.
Starting Docker auth server...
Error response from daemon: Cannot kill container: conf_dockerauth_1: No such container: conf_dockerauth_1
Error response from daemon: Cannot kill container: conf_dockerauth_1: No such container: conf_dockerauth_1
Error: No such container: conf_dockerauth_1
Error: No such container: conf_registry_1
Started Docker auth server.
Creating conf_registry_1 ...
Creating conf_dockerauth_1 ...
Creating conf_registry_1   ... done
Creating conf_dockerauth_1 ... done
Attaching to conf_registry_1, conf_dockerauth_1
 registry_1      time="2022-05-01T09:53:17.783617546Z" level=info msg="redis not configured" go.version=go1.16.15 instance.id=308805e6-9b56-4025-a9c4-18343b27fe6f service=registry version="v2.8.1+unknown"
 registry_1      time="2022-05-01T09:53:17.793321085Z" level=info msg="Starting upload purge in 28m0s" go.version=go1.16.15 instance.id=308805e6-9b56-4025-a9c4-18343b27fe6f service=registry version="v2.8.1+unknown"
 registry_1      time="2022-05-01T09:53:17.798953317Z" level=info msg="using inmemory blob descriptor cache" go.version=go1.16.15 instance.id=308805e6-9b56-4025-a9c4-18343b27fe6f service=registry version="v2.8.1+unknown"
 registry_1      time="2022-05-01T09:53:17.803640662Z" level=info msg="restricting TLS version to tls1.2 or higher" go.version=go1.16.15 instance.id=308805e6-9b56-4025-a9c4-18343b27fe6f service=registry version="v2.8.1+unknown"
 registry_1      time="2022-05-01T09:53:17.804642705Z" level=info msg="restricting TLS cipher suites to: TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_AES_128_GCM_SHA256,TLS_CHACHA20_POLY1305_SHA256,TLS_AES_256_GCM_SHA384" go.version=go1.16.15 instance.id=308805e6-9b56-4025-a9c4-18343b27fe6f service=registry version="v2.8.1+unknown"
 registry_1      time="2022-05-01T09:53:17.806382116Z" level=info msg="listening on [::]:5000, tls" go.version=go1.16.15 instance.id=308805e6-9b56-4025-a9c4-18343b27fe6f service=registry version="v2.8.1+unknown"
 dockerauth_1    I0501 09:53:17.952263       1 main.go:246] docker_auth 20211207 build 20211207-204332/1.9.0@636c09af
 dockerauth_1    I0501 09:53:17.966788       1 main.go:61] Config from /config/extAuth.yml (1 users, 2 ACL static entries)
 dockerauth_1    I0501 09:53:17.967927       1 acl.go:109] Created ACL Authorizer with 2 entries
 dockerauth_1    I0501 09:53:17.968522       1 main.go:110] Cert file: /ssl/fullchain.pem
 dockerauth_1    I0501 09:53:17.969074       1 main.go:111] Key file : /ssl/privkey.pem
 dockerauth_1    I0501 09:53:17.970224       1 main.go:173] Serving on :5001
 registry_1      time="2022-05-01T09:53:34.856832431Z" level=warning msg="error authorizing context: authorization token required" go.version=go1.16.15 http.request.host=docker-repository.xen.emi.sztaki.hu http.request.id=c85501af-4762-48cc-a1fb-b706efdcbb0a http.request.method=GET http.request.remoteaddr=" <REDACTED_LOCAL_IP>:59516" http.request.uri="/v2/" http.request.useragent="docker/20.10.14 go/go1.18 git-commit/87a90dc786 kernel/5.17.3-arch1-1 os/linux arch/amd64 UpstreamClient(Docker-Client/20.10.14 \(linux\))"
 registry_1       <REDACTED_LOCAL_IP> - - [01/May/2022:09:53:34 +0000] "GET /v2/ HTTP/1.1" 401 87 "" "docker/20.10.14 go/go1.18 git-commit/87a90dc786 kernel/5.17.3-arch1-1 os/linux arch/amd64 UpstreamClient(Docker-Client/20.10.14 \\(linux\\))"
 dockerauth_1    I0501 09:53:35.662863       1 server.go:488] Auth request: { <REDACTED_USER>:***@ <REDACTED_LOCAL_IP>:57392 [{repository  postgres [pull push]}]}
 dockerauth_1    I0501 09:53:35.664106       1 server.go:317] Authn static  <REDACTED_USER> -> false, map[], did not match any rule
 dockerauth_1    I0501 09:53:35.696000       1 ldap_auth.go:216] DialTLS: starting... <REDACTED_LDAP_SERVER_NAME>
 dockerauth_1    I0501 09:53:35.758340       1 ldap_auth.go:137] Bind read-only user (DN =  <REDACTED_LDAP_DN>)
 dockerauth_1    I0501 09:53:35.762864       1 ldap_auth.go:227] search filter is  <REDACTED_LDAP_FILTER>
 dockerauth_1    I0501 09:53:35.763865       1 ldap_auth.go:237] Searching...basedDN: <REDACTED_LDAP_BASE_DN>, filter: <REDACTED_LDAP_FILTER>
 dockerauth_1    I0501 09:53:35.772206       1 ldap_auth.go:260] Entry  <REDACTED_LDAP_ENTRY>
 dockerauth_1    I0501 09:53:35.776342       1 ldap_auth.go:137] Bind read-only user (DN =  <REDACTED_LDAP_DN>)
 dockerauth_1    I0501 09:53:35.780403       1 server.go:317] Authn LDAP  <REDACTED_USER> -> true, map[], <nil>
 dockerauth_1    I0501 09:53:35.781136       1 acl.go:121] { <REDACTED_USER> pull,push repository postgres} matched {"Match": <REDACTED_MATCH_RULE>,"Actions":null,"Comment":null} (Comment: (nil))
 dockerauth_1    I0501 09:53:35.782210       1 server.go:3160] http: panic serving  <REDACTED_LOCAL_IP>:57392: runtime error: invalid memory address or nil pointer dereference
 dockerauth_1    goroutine 12 [running]:
 dockerauth_1    net/http.(*conn).serve.func1()
 dockerauth_1       /usr/local/go/src/net/http/server.go:1802 +0xb9
 dockerauth_1    panic({0xeefa80, 0x18de080})
 dockerauth_1       /usr/local/go/src/runtime/panic.go:1047 +0x266
 dockerauth_1    github.com/cesanta/docker_auth/auth_server/authz.(*aclAuthorizer).Authorize(0x8, 0xc0000dab80)
 dockerauth_1       /build/authz/acl.go:122 +0x217
 dockerauth_1    github.com/cesanta/docker_auth/auth_server/server.(*AuthServer).authorizeScope(0xc0000ef7d0, 0xc0000dab80)
 dockerauth_1       /build/server/server.go:338 +0xfb
 dockerauth_1    github.com/cesanta/docker_auth/auth_server/server.(*AuthServer).Authorize(0xc000079f20, 0xc000342960)
 dockerauth_1       /build/server/server.go:367 +0x245
 dockerauth_1    github.com/cesanta/docker_auth/auth_server/server.(*AuthServer).doAuth(0xc000079f20, {0x122d3f0, 0xc000314620}, 0x10222c4)
 dockerauth_1       /build/server/server.go:504 +0x287
 dockerauth_1    github.com/cesanta/docker_auth/auth_server/server.(*AuthServer).ServeHTTP(0xc000079f20, {0x122d3f0, 0xc000314620}, 0xc0000dc200)
 dockerauth_1       /build/server/server.go:443 +0x566
 dockerauth_1    net/http.serverHandler.ServeHTTP({0xc0003786f0}, {0x122d3f0, 0xc000314620}, 0xc0000dc200)
 dockerauth_1       /usr/local/go/src/net/http/server.go:2879 +0x43b
 dockerauth_1    net/http.(*conn).serve(0xc0003428c0, {0x1232a18, 0xc0003783f0})
 dockerauth_1       /usr/local/go/src/net/http/server.go:1930 +0xb08
 dockerauth_1    created by net/http.(*Server).Serve
 dockerauth_1       /usr/local/go/src/net/http/server.go:3034 +0x4e8

[hooger]

My problem was wrong ACL records. It looked like this:

  - match:
      account: /admin1|admin2/
    actions: ["*"]

while it should look like this:

  - match: {account: "admin1"}                                                                                                                              
    actions: ["*"]                                                                                                                                          
    comment: "This will allow some authenticated users to pull/push"                                                                                        
  - match: {account: "admin2"}                                                                                                                            
    actions: ["*"]                                                                                                                                          
    comment: "This will allow some authenticated users to pull/push" 

Sorry for the noise, good job with the sw! Best regards,