Repository navigation
Expand file tree
/
Copy pathdocker_auth.go
More file actions
290 lines (238 loc) · 7.77 KB
/
Copy pathdocker_auth.go
File metadata and controls
290 lines (238 loc) · 7.77 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
package testcontainers
import (
"context"
"crypto/md5"
"encoding/base64"
"encoding/hex"
"encoding/json"
"errors"
"fmt"
"net/url"
"os"
"strings"
"sync"
"github.com/cpuguy83/dockercfg"
"github.com/moby/moby/api/types/registry"
"github.com/moby/moby/client"
"github.com/testcontainers/testcontainers-go/internal/core"
)
// defaultRegistryFn is variable overwritten in tests to check for behaviour with different default values.
var defaultRegistryFn = defaultRegistry
// getRegistryCredentials is a variable overwritten in tests to mock the dockercfg.GetRegistryCredentials function.
var getRegistryCredentials = dockercfg.GetRegistryCredentials
// DockerImageAuth returns the auth config for the given Docker image, extracting first its Docker registry.
// Finally, it will use the credential helpers to extract the information from the docker config file
// for that registry, if it exists.
func DockerImageAuth(ctx context.Context, image string) (string, registry.AuthConfig, error) {
configs, err := getDockerAuthConfigs()
if err != nil {
reg := core.ExtractRegistry(image, defaultRegistryFn(ctx))
return reg, registry.AuthConfig{}, err
}
return dockerImageAuth(ctx, image, configs)
}
// dockerImageAuth returns the auth config for the given Docker image.
func dockerImageAuth(ctx context.Context, image string, configs map[string]registry.AuthConfig) (string, registry.AuthConfig, error) {
defaultRegistry := defaultRegistryFn(ctx)
reg := core.ExtractRegistry(image, defaultRegistry)
// Normalize Docker Hub aliases for credential lookup
if strings.EqualFold(reg, "docker.io") ||
strings.EqualFold(reg, "registry.hub.docker.com") ||
strings.EqualFold(reg, "registry-1.docker.io") {
reg = defaultRegistry // This is https://index.docker.io/v1/
}
if cfg, ok := getRegistryAuth(reg, configs); ok {
return reg, cfg, nil
}
return reg, registry.AuthConfig{}, dockercfg.ErrCredentialsNotFound
}
func getRegistryAuth(reg string, cfgs map[string]registry.AuthConfig) (registry.AuthConfig, bool) {
if cfg, ok := cfgs[reg]; ok {
return cfg, true
}
// fallback match using authentication key host
for k, cfg := range cfgs {
keyURL, err := url.Parse(k)
if err != nil {
continue
}
host := keyURL.Host
if keyURL.Scheme == "" {
// url.Parse: The url may be relative (a path, without a host) [...]
host = keyURL.Path
}
if host == reg {
return cfg, true
}
}
return registry.AuthConfig{}, false
}
// defaultRegistry returns the default registry to use when pulling images
// It will use the docker daemon to get the default registry, returning "https://index.docker.io/v1/" if
// it fails to get the information from the daemon
func defaultRegistry(ctx context.Context) string {
apiClient, err := NewDockerClientWithOpts(ctx)
if err != nil {
return core.IndexDockerIO
}
defer apiClient.Close()
info, err := apiClient.Info(ctx, client.InfoOptions{})
if err != nil {
return core.IndexDockerIO
}
return info.Info.IndexServerAddress
}
// authConfigResult is a result looking up auth details for key.
type authConfigResult struct {
key string
cfg registry.AuthConfig
err error
}
// credentialsCache is a cache for registry credentials.
type credentialsCache struct {
entries map[string]credentials
mtx sync.RWMutex
}
// credentials represents the username and password for a registry.
type credentials struct {
username string
password string
}
var creds = &credentialsCache{entries: map[string]credentials{}}
// AuthConfig updates the details in authConfig for the given hostname
// as determined by the details in configKey.
func (c *credentialsCache) AuthConfig(hostname, configKey string, authConfig *registry.AuthConfig) error {
u, p, err := creds.get(hostname, configKey)
if err != nil {
return err
}
if u != "" {
authConfig.Username = u
authConfig.Password = p
} else {
authConfig.IdentityToken = p
}
return nil
}
// get returns the username and password for the given hostname
// as determined by the details in configPath.
// If the username is empty, the password is an identity token.
func (c *credentialsCache) get(hostname, configKey string) (string, string, error) {
key := configKey + ":" + hostname
c.mtx.RLock()
entry, ok := c.entries[key]
c.mtx.RUnlock()
if ok {
return entry.username, entry.password, nil
}
// No entry found, request and cache.
user, password, err := getRegistryCredentials(hostname)
if err != nil {
return "", "", fmt.Errorf("getting credentials for %s: %w", hostname, err)
}
c.mtx.Lock()
c.entries[key] = credentials{username: user, password: password}
c.mtx.Unlock()
return user, password, nil
}
// configKey returns a key to use for caching credentials based on
// the contents of the currently active config.
func configKey(cfg *dockercfg.Config) (string, error) {
h := md5.New()
if err := json.NewEncoder(h).Encode(cfg); err != nil {
return "", fmt.Errorf("encode config: %w", err)
}
return hex.EncodeToString(h.Sum(nil)), nil
}
// getDockerAuthConfigs returns a map with the auth configs from the docker config file
// using the registry as the key
func getDockerAuthConfigs() (map[string]registry.AuthConfig, error) {
cfg, err := getDockerConfig()
if err != nil {
if errors.Is(err, os.ErrNotExist) {
return map[string]registry.AuthConfig{}, nil
}
return nil, err
}
key, err := configKey(cfg)
if err != nil {
return nil, err
}
size := len(cfg.AuthConfigs) + len(cfg.CredentialHelpers)
cfgs := make(map[string]registry.AuthConfig, size)
results := make(chan authConfigResult, size)
var wg sync.WaitGroup
wg.Add(size)
for k, v := range cfg.AuthConfigs {
go func(k string, v dockercfg.AuthConfig) {
defer wg.Done()
ac := registry.AuthConfig{
Auth: v.Auth,
IdentityToken: v.IdentityToken,
Password: v.Password,
RegistryToken: v.RegistryToken,
ServerAddress: v.ServerAddress,
Username: v.Username,
}
switch {
case ac.Username == "" && ac.Password == "":
// Look up credentials from the credential store.
if err := creds.AuthConfig(k, key, &ac); err != nil {
results <- authConfigResult{err: err}
return
}
case ac.Auth == "":
// Create auth from the username and password encoding.
ac.Auth = base64.StdEncoding.EncodeToString([]byte(ac.Username + ":" + ac.Password))
}
results <- authConfigResult{key: k, cfg: ac}
}(k, v)
}
// In the case where the auth field in the .docker/conf.json is empty, and the user has
// credential helpers registered the auth comes from there.
for k := range cfg.CredentialHelpers {
go func(k string) {
defer wg.Done()
var ac registry.AuthConfig
if err := creds.AuthConfig(k, key, &ac); err != nil {
results <- authConfigResult{err: err}
return
}
results <- authConfigResult{key: k, cfg: ac}
}(k)
}
go func() {
wg.Wait()
close(results)
}()
var errs []error
for result := range results {
if result.err != nil {
errs = append(errs, result.err)
continue
}
cfgs[result.key] = result.cfg
}
if len(errs) > 0 {
return nil, errors.Join(errs...)
}
return cfgs, nil
}
// getDockerConfig returns the docker config file. It will internally check, in this particular order:
// 1. the DOCKER_AUTH_CONFIG environment variable, unmarshalling it into a dockercfg.Config
// 2. the DOCKER_CONFIG environment variable, as the path to the config file
// 3. else it will load the default config file, which is ~/.docker/config.json
func getDockerConfig() (*dockercfg.Config, error) {
if env := os.Getenv("DOCKER_AUTH_CONFIG"); env != "" {
var cfg dockercfg.Config
if err := json.Unmarshal([]byte(env), &cfg); err != nil {
return nil, fmt.Errorf("unmarshal DOCKER_AUTH_CONFIG: %w", err)
}
return &cfg, nil
}
cfg, err := dockercfg.LoadDefaultConfig()
if err != nil {
return nil, fmt.Errorf("load default config: %w", err)
}
return &cfg, nil
}