[Bug]: Failed authentication from private repository with credHelpers

[rokjoana]

Testcontainers version

0.19.0

Using the latest Testcontainers version?

Yes

Host OS

macOS Intel

Host arch

x86

Go version

1.20

Docker version

Client:
 Cloud integration: v1.0.31
 Version:           20.10.24
 API version:       1.41
 Go version:        go1.19.7
 Git commit:        297e128
 Built:             Tue Apr  4 18:21:21 2023
 OS/Arch:           darwin/amd64
 Context:           desktop-linux
 Experimental:      true

Server: Docker Desktop 4.18.0 (104112)
 Engine:
  Version:          20.10.24
  API version:      1.41 (minimum version 1.12)
  Go version:       go1.19.7
  Git commit:       5d6db84
  Built:            Tue Apr  4 18:18:42 2023
  OS/Arch:          linux/amd64
  Experimental:     false
 containerd:
  Version:          1.6.18
  GitCommit:        2456e983eb9e37e47538f59ea18f2043c9a73640
 runc:
  Version:          1.1.4
  GitCommit:        v1.1.4-0-g5fd4c4d
 docker-init:
  Version:          0.19.0
  GitCommit:        de40ad0

Docker info

Client:
 Context:    desktop-linux
 Debug Mode: false
 Plugins:
  buildx: Docker Buildx (Docker Inc., v0.10.4)
  compose: Docker Compose (Docker Inc., v2.17.2)
  dev: Docker Dev Environments (Docker Inc., v0.1.0)
  extension: Manages Docker extensions (Docker Inc., v0.2.19)
  init: Creates Docker-related starter files for your project (Docker Inc., v0.1.0-beta.2)
  sbom: View the packaged-based Software Bill Of Materials (SBOM) for an image (Anchore Inc., 0.6.0)
  scan: Docker Scan (Docker Inc., v0.25.0)
  scout: Command line tool for Docker Scout (Docker Inc., v0.9.0)

Server:
 Containers: 0
  Running: 0
  Paused: 0
  Stopped: 0
 Images: 2
 Server Version: 20.10.24
 Storage Driver: overlay2
  Backing Filesystem: extfs
  Supports d_type: true
  Native Overlay Diff: true
  userxattr: false
 Logging Driver: json-file
 Cgroup Driver: cgroupfs
 Cgroup Version: 2
 Plugins:
  Volume: local
  Network: bridge host ipvlan macvlan null overlay
  Log: awslogs fluentd gcplogs gelf journald json-file local logentries splunk syslog
 Swarm: inactive
 Runtimes: io.containerd.runc.v2 io.containerd.runtime.v1.linux runc
 Default Runtime: runc
 Init Binary: docker-init
 containerd version: 2456e983eb9e37e47538f59ea18f2043c9a73640
 runc version: v1.1.4-0-g5fd4c4d
 init version: de40ad0
 Security Options:
  seccomp
   Profile: default
  cgroupns
 Kernel Version: 5.15.49-linuxkit
 Operating System: Docker Desktop
 OSType: linux
 Architecture: x86_64
 CPUs: 4
 Total Memory: 7.773GiB
 Name: docker-desktop
 ID: HB76:PKZ2:CB3Q:W7PV:HK2Q:VUCW:TQMH:KNTZ:FJBF:WNIM:DMU2:ZLPV
 Docker Root Dir: /var/lib/docker
 Debug Mode: true
  File Descriptors: 42
  Goroutines: 49
  System Time: 2023-04-17T18:32:48.325708796Z
  EventsListeners: 7
 HTTP Proxy: http.docker.internal:3128
 HTTPS Proxy: http.docker.internal:3128
 No Proxy: hubproxy.docker.internal
 Registry: https://index.docker.io/v1/
 Labels:
 Experimental: false
 Insecure Registries:
  hubproxy.docker.internal:5555
  127.0.0.0/8
 Live Restore Enabled: false

What happened?

I was trying to create a container from an image stored in a private GCP container registry but got an unauthorized error. I'm authenticating with the recommended method from google, using the credential helper. Since my ~/.docker/config.json doesn't have any auths field, testcontainers-go doesn't get the credentials from the credential helper:
On line https://github.com/rokjoana/testcontainers-go/blob/main/docker_auth.go#L53 the code only goes through the array of cfg.AuthConfigs to get the credentials. If the array is empty, it doesn't call the method to get the credentials using the docker credential helper. This method should check also if the field cfg.CredentialHelpers exist if cfg.AuthConfigs is empty and call dockercfg.GetRegistryCredentials().

Relevant log output

2023/04/17 17:07:28 Failed to get image auth for eu.gcr.io. Setting empty credentials for the image: eu.gcr.io/kramphub-toolshed-shared/pubsub-emulator:2.0.0. Error is:credentials not found in native keychain
2023/04/17 17:07:29 Failed to pull image: Error response from daemon: unauthorized: You don't have the needed permissions to perform this operation, and you may have invalid credentials. To authenticate your request, follow the steps in: https://cloud.google.com/container-registry/docs/advanced-authentication, will retry

Additional information

No response

[mdelapenya]

Thanks for opening the report and describing the expected behaviour. Are you willing to contribute it?

[rokjoana]

yes, I'm working on it.

[mdelapenya]

I'm labelling this issue as a feature, as it's a new behaviour that was not covered by the original one

[dawidwys]

I also faced this issue. One comment to:

This method should check also if the field cfg.CredentialHelpers exist if cfg.AuthConfigs is empty

I'd say it should always check the credsHelpers. In my case I have an entry in the auths section, but I have also additional entries in credHelpers which are not present in auths

[rokjoana]

@dawidwys you are right, it should always check the credHelpers. I've changed my fix accordingly.