chrisxaustin
commented
3 years ago I know this is an old Issue, but I ran into this today with 1.4.13 and spent too much time troubleshooting it.
TL;DR - updating .docker/config.json to use credsStore=ecr-login is easiest. It also needs to have the registry in the auths section.
{
"auths": {
"12345.dkr.ecr.us-east-2.amazonaws.com": {}
},
"HttpHeaders": {
"User-Agent": "Docker-Client/18.09.0 (windows)"
},
"credsStore": "ecr-login"
}I use the AWS Tools for PowerShell, but I suspect we have a similar problem. To authenticate I run:
Invoke-Expression -Command (Get-ECRLoginCommand -Region us-east-2).Command
My .docker/config.json was auto-generated when I logged in, with these contents after I deleted the file and let docker re-create it.
{
"auths": {
"12345.dkr.ecr.us-east-2.amazonaws.com": {}
},
"HttpHeaders": {
"User-Agent": "Docker-Client/18.09.0 (windows)"
},
"credsStore": "wincred"
}Pushing with this failed, so I ran maven with the -X flag for debug output and saw the call to docker-credential-wincred get.
Stepping through the plugin execution in an attached debug session I saw ConfigFileRegistryAuthSupplier.authFor try the https variant and fail because docker-credential-wincred doesn't have that registry, as confirmed with
echo https://12345.dkr.ecr.us-east-2.amazonaws.com | docker-credential-wincred getTrying without the protocol works:
echo 12345.dkr.ecr.us-east-2.amazonaws.com | docker-credential-wincred getThe plugin then tried without the protocol (yay!), but because config.json has a stub entry for that name DockerConfigReader.authForRegistry returned the empty object with no auth info and never reached the credsStore piece.
These options don't work:
- add the https:// repository url to the auths section
- remove the auths section - the build process fails when DockerConfigReader.authForAllRegistries doesn't add the credsStore since hasAuths is now false
- add a stub entry to auths for a different name - the build fails since DockerConfigReader.authForAllRegistries only adds the credsStore for the registries named in the auths section
I believe these to be bugs:
- The build path works properly and uses the authForAllRegistries, but the push path doesn't do the same.
- DockerConfigReader.authForRegistry should check for empty auth and then fallback to credsStore
stale[bot]
Is this a BUG REPORT or FEATURE REQUEST?: Bug report
Description
Cannot push images to ECR. I've tried using 1.3.3 and using docker-client version 8.10 per this old issue, but neither can connect to my docker client.
How to reproduce
dockerfile.repositoryper ECR's required structureaws ecr create-repository --repository-name "$(mvn help:evaluate "-Dexpression=dockerfile.repository" -q -DforceStdout)"${ecr_name}in the commandaws ecr get-login-password | docker login --username AWS --password-stdin "${ecr_name}"mvn packagemvn dockerfile:push- failsWhat do you expect
mvn dockerfile:pushsucceeds wheneverdocker pushwouldWhat happened instead
push fails with error
Software:
docker version:Server: Docker Engine - Community Engine: Version: 19.03.13 API version: 1.40 (minimum version 1.12) Go version: go1.13.15 Git commit: 4484c46d9d Built: Wed Sep 16 17:07:04 2020 OS/Arch: linux/amd64 Experimental: false containerd: Version: v1.3.7 GitCommit: 8fba4e9a7d01810a393d5d25a3621dc101981175 runc: Version: 1.0.0-rc10 GitCommit: dc9208a3303feef5b3839f4323d9beb36df0a9dd docker-init: Version: 0.18.0 GitCommit: fec3683