docker / docker-credential-helpers

Programs to keep Docker login credentials safe by storing in platform keystores
MIT License
1.07k stars 169 forks source link

Handle parallel calls to `docker login` with osxkeychain #333

Open beejeebus opened 1 month ago

beejeebus commented 1 month ago

When docker login private-registry.example.com is called in parallel, some of the calls fail with the error The specified item already exists in the keychain.

Assuming a docker config with osxkeychain:

$ jq .credsStore ~/.docker/config.json
"osxkeychain"
$ jq .auths ~/.docker/config.json
{
  "private-registry.example.com": {}
}

Then the issue can be reproduced like this:

~ $ (docker login private-registry.example.com &) && (docker login private-registry.example.com &) && docker login private-registry.example.com
Authenticating with existing credentials...
Authenticating with existing credentials...
Authenticating with existing credentials...
Error saving credentials: error storing credentials - err: exit status 1, out: `The specified item already exists in the keychain.`
Error saving credentials: error storing credentials - err: exit status 1, out: `The specified item already exists in the keychain.`
Login Succeeded

The processes that lose the race report an error, even though the credentials were successfully added by the winner of the race.