Add support for registry authentication

[ahromis]

I was having issues with the cert chain, so I followed what is on this thread for docker-osx: moby/moby#3683 . I'm able to do a docker login just fine using a new binary on mac os x.

However when using fig and having the Dockerfile pull from the same private registry I get the following error using fig build:

Step 1 : FROM ssl-repo.com/image
Pulling repository ssl-repo.com/image
Error: Authentication is required.

Does fig read the .dockercfg? Any other ideas on what the issue could be here?

[bfirsh]

No it doesn't, and we should support that. Thanks for the suggestion!

[thpham]

@ahromis @bfirsh I notice that the authentication with fig and .dockercfg works but the registry should be declared with an url that include the version (ex. https://private_registry.domain.tld/v1/ ). It seems there is a bug https://github.com/orchardup/fig/blob/master/fig/packages/docker/auth/auth.py#L66 if you did a
$ docker login https://private_registry.domain.tld

[zazabe]

@thpham Thanks, works fine with the official private repository in version 0.8.0.
Just a note, you have to use a full url at login and in your fig.yml file, with the protocol part.

[allenan]

Really looking for this functionality as well. Any suggested workarounds for the time being?

[matthuisman]

I'm having a similar issue using a private registry:

nginx:
image: docker.mydomain.com/matt/nginx:latest
ports:
- "80:80"

If I do docker pull docker.mydomain.com/matt/nginx:latest
it works fine

However, if I do a fig up
I get:

Pulling nginx (docker.mydomain.com/matt/nginx:latest )...
Traceback (most recent call last):
File "", line 3, in
File "/code/build/fig/out00-PYZ.pyz/fig.cli.main", line 31, in main
File "/code/build/fig/out00-PYZ.pyz/fig.cli.docopt_command", line 21, in sys_dispatch
File "/code/build/fig/out00-PYZ.pyz/fig.cli.command", line 28, in dispatch
File "/code/build/fig/out00-PYZ.pyz/fig.cli.docopt_command", line 24, in dispatch
File "/code/build/fig/out00-PYZ.pyz/fig.cli.command", line 51, in perform_command
File "/code/build/fig/out00-PYZ.pyz/fig.cli.main", line 225, in pull
File "/code/build/fig/out00-PYZ.pyz/fig.project", line 185, in pull
File "/code/build/fig/out00-PYZ.pyz/fig.service", line 431, in pull
File "/code/build/fig/out00-PYZ.pyz/docker.client", line 733, in pull
File "/code/build/fig/out00-PYZ.pyz/docker.auth.auth", line 69, in resolve_repository_name
File "/code/build/fig/out00-PYZ.pyz/docker.auth.auth", line 48, in expand_registry_url
docker.errors.DockerException: HTTPS endpoint unresponsive and insecure mode isn't enabled.

Any ideas?

[mattupstate]

@matthuisman you might try setting an environment variable in the shell you're calling fig from:

$ REQUESTS_CA_BUNDLE=/path/to/ca.crt fig <command>

This might help since fig uses the requests library internally and it supports this env var.

[chadshowalter]

I'm having a similar issue. If I don't set REQUESTS_CA_BUNDLE, I see the stacktrace posted by @matthuisman. If I set REQUESTS_CA_BUNDLE to the path to my crt, I get:

Pulling image my-private-docker-registry:8080/demo-simulator:10...
Traceback (most recent call last):
File "", line 3, in
File "/code/build/fig/out00-PYZ.pyz/fig.cli.main", line 31, in main
File "/code/build/fig/out00-PYZ.pyz/fig.cli.docopt_command", line 21, in sys_dispatch
File "/code/build/fig/out00-PYZ.pyz/fig.cli.command", line 28, in dispatch
File "/code/build/fig/out00-PYZ.pyz/fig.cli.docopt_command", line 24, in dispatch
File "/code/build/fig/out00-PYZ.pyz/fig.cli.command", line 56, in perform_command
File "/code/build/fig/out00-PYZ.pyz/fig.cli.main", line 427, in up
File "/code/build/fig/out00-PYZ.pyz/fig.project", line 174, in up
File "/code/build/fig/out00-PYZ.pyz/fig.service", line 199, in recreate_containers
File "/code/build/fig/out00-PYZ.pyz/fig.service", line 187, in create_container
File "/code/build/fig/out00-PYZ.pyz/fig.progress_stream", line 37, in stream_output
File "/code/build/fig/out00-PYZ.pyz/fig.progress_stream", line 50, in print_output_event
fig.progress_stream.StreamOutputError: Authentication is required.

If instead I do:

docker pull my-private-docker-registry:8080/demo-simulator:10

it works (assuming my .dockercfg includes a valid login).

Is there a workaround, or is using fig with a SSL private repository currently not supported?

[amosschallich]

I am still having the issue with logging in to a private repository.
It seems from other commenters that this may have been solved, but I cannot get it to work with Fig 1.0.1.
Any sample fig.yml file that shows how to use a Basic Auth with a private repository behind https would be greatly appreciated.

[gregtap]

Same issue here even with latest src from master.

Pulling image registry.xxxx.com/live:dev...
Traceback (most recent call last):
  File "/usr/local/bin/fig", line 9, in <module>
load_entry_point('fig==1.0.1', 'console_scripts', 'fig')()
   File "build/bdist.macosx-10.10-intel/egg/fig/cli/main.py", line 31, in main
   File "build/bdist.macosx-10.10-intel/egg/fig/cli/docopt_command.py", line 21, in sys_dispatch
   File "build/bdist.macosx-10.10-intel/egg/fig/cli/command.py", line 28, in dispatch
   File "build/bdist.macosx-10.10-intel/egg/fig/cli/docopt_command.py", line 24, in dispatch
   File "build/bdist.macosx-10.10-intel/egg/fig/cli/command.py", line 56, in perform_command
   File "build/bdist.macosx-10.10-intel/egg/fig/cli/main.py", line 434, in up
   File "build/bdist.macosx-10.10-intel/egg/fig/project.py", line 174, in up
   File "build/bdist.macosx-10.10-intel/egg/fig/service.py", line 222, in recreate_containers
   File "build/bdist.macosx-10.10-intel/egg/fig/service.py", line 210, in create_container
   File "build/bdist.macosx-10.10-intel/egg/fig/progress_stream.py", line 37, in stream_output
   File "build/bdist.macosx-10.10-intel/egg/fig/progress_stream.py", line 50, in print_output_event

fig.progress_stream.StreamOutputError: Authentication is required.

When I add a:

print self.client.info()

In service.py L207 it clearly states:

{
    "KernelVersion": "3.16.7-tinycore64",
    "NFd": 36,
    "Debug": 1,
    ....
   "IndexServerAddress": "https://index.docker.io/v1/",

}

It seems that the IndexServerAddress is not updated to my own private repo.

However self.client._auth_configs returns what seems to be the proper conf.

{u'https://registry.xxxxx.com': {'username': xxxx', 'password': u'xxxxxx', 'email': u'xxxx@xxxxx', 'serveraddress': u'https://registry.xxxx.com'}}

[JamesStewy]

I had the same issue as well. After looking around in docker-py I found docker/docker-py#241. The solution found was to add /v1/ to the registry address. You can do this in two ways either edit .dockercfg and change the registry address to https://mydomain.com/v1/ or run docker logout https://mydomain.com/ and then docker login https://mydomain.com/v1/. Both Docker and Fig work with this configuration. Tested with Docker 1.3.2, Fig 1.0.1 and Docker Registry 0.9.0.

[amosschallich]

This worked for me as well. Thank you for the update

[cedvan]

👍 docker login https://mydomain.com/v1/ work