search

fussybeaver / bollard

Docker daemon API in Rust
Apache License 2.0
907 stars 134 forks source link

fix: Don't populate X-Registry-* headers when credentials are not set #430

Closed eplightning closed 4 months ago

eplightning commented 4 months ago

Currently bollard unconditionally sends credentials (X-Registry-*) headers to Docker API, even when credentials are not specified (None is passed). For example request for image pull will look like this, despite having no specified credentials:

POST /images/create?fromImage=...&fromSrc=&repo=&tag=&platform= HTTP/1.1\r
x-registry-auth: eyJ1c2VybmFtZSI6bnVsbCwicGFzc3dvcmQiOm51bGwsImF1dGgiOm51bGwsImVtYWlsIjpudWxsLCJzZXJ2ZXJhZGRyZXNzIjpudWxsLCJpZGVudGl0eXRva2VuIjpudWxsLCJyZWdpc3RyeXRva2VuIjpudWxsfQ==\r
content-type: application/json\r
host: ...\r

(the base64 decoded auth is {"username":null,"password":null,"auth":null,"email":null,"serveraddress":null,"identitytoken":null,"registrytoken":null})

For Podman doing so causes it use those "empty" credentials instead of the default system ones, breaking functionality like registry mirrors and so on.

This PR does a small refactoring and sets this header to be empty when they are not specified, bringing it closer to behavior of other Docker libraries (empty or not set).

eplightning commented 4 months ago

Hmm any idea why Windows tests try to push the image without any credentials? I'm not sure if that makes sense but I have absolutely no experience with Windows.

I suppose we could do what Java does and explictly mark push call as requiring authentication and send empty object in that case: https://github.com/docker-java/docker-java/blob/a1393bf2e1265ba1e6eca4240af55396852f8a7c/docker-java-core/src/main/java/com/github/dockerjava/core/exec/AbstrDockerCmdExec.java#L75

fussybeaver commented 4 months ago

Great! Thank you..