fix: docker auth for docker.io images #3482
Conversation
✅ Deploy Preview for testcontainers-go ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
Summary by CodeRabbit
✏️ Tip: You can customize this high-level summary in your review settings. WalkthroughNormalizes Docker Hub registry aliases (case-insensitive) before credential lookup and adds a test verifying default-registry authentication matching for docker.io image references. Changes
Sequence Diagram(s)sequenceDiagram
participant Client as Caller
participant Images as ExtractRegistry
participant Norm as Registry Normalizer
participant Auth as getRegistryAuth
participant Result as Auth Result
Client->>Images: Provide image ref ("docker.io/my/image:latest")
Images->>Norm: Extract registry
alt registry is docker.io / hub alias (case-insensitive)
Norm->>Images: Return default registry (normalized)
else other registry
Norm->>Images: Return extracted registry
end
Images->>Auth: getRegistryAuth(registry)
Auth->>Result: credentials / error
Result-->>Client: auth (username/password/Auth) or error
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes
Poem
Pre-merge checks and finishing touches✅ Passed checks (3 passed)
✨ Finishing touches
🧪 Generate unit tests (beta)
📜 Recent review detailsConfiguration used: CodeRabbit UI Review profile: CHILL Plan: Pro 📒 Files selected for processing (2)
🚧 Files skipped from review as they are similar to previous changes (1)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (15)
🔇 Additional comments (1)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
LaurentGoderre
changed the title
LaurentGoderre
force-pushed
the
fix-docker-dot-io
branch
from
bf4458c to
df49f93
Compare
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (2)
docker_auth.go(1 hunks)docker_auth_test.go(1 hunks)
🚧 Files skipped from review as they are similar to previous changes (1)
- docker_auth_test.go
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (20)
- GitHub Check: lint (modules/dynamodb) / lint: modules/dynamodb
- GitHub Check: lint (modulegen) / lint: modulegen
- GitHub Check: lint (modules/dind) / lint: modules/dind
- GitHub Check: lint (modules/registry) / lint: modules/registry
- GitHub Check: lint (modules/dockermodelrunner) / lint: modules/dockermodelrunner
- GitHub Check: lint (modules/postgres) / lint: modules/postgres
- GitHub Check: lint (modules/qdrant) / lint: modules/qdrant
- GitHub Check: lint (modules/pinecone) / lint: modules/pinecone
- GitHub Check: lint (modules/redpanda) / lint: modules/redpanda
- GitHub Check: lint (modules/solace) / lint: modules/solace
- GitHub Check: lint (modules/memcached) / lint: modules/memcached
- GitHub Check: lint (modules/openfga) / lint: modules/openfga
- GitHub Check: lint (modules/pulsar) / lint: modules/pulsar
- GitHub Check: lint (modules/artemis) / lint: modules/artemis
- GitHub Check: lint (modules/influxdb) / lint: modules/influxdb
- GitHub Check: lint (modules/rabbitmq) / lint: modules/rabbitmq
- GitHub Check: lint (modules/dolt) / lint: modules/dolt
- GitHub Check: lint (modules/mariadb) / lint: modules/mariadb
- GitHub Check: lint (modules/consul) / lint: modules/consul
- GitHub Check: Analyze (go)
LaurentGoderre
force-pushed
the
fix-docker-dot-io
branch
from
df49f93 to
00cbc7d
Compare
docker_auth.go
Outdated
| // Make comparison case-insensitive and handle both aliases | ||
| if strings.EqualFold(reg, "docker.io") || strings.EqualFold(reg, "registry.hub.docker.com") { | ||
| reg = defaultRegistry | ||
| } | ||
|
|
There was a problem hiding this comment.
question: should this be handled by core.ExtractRegistry?
There was a problem hiding this comment.
It could. Up to y'all
There was a problem hiding this comment.
I think it should live there, @mdelapenya thoughts?
There was a problem hiding this comment.
Yeah, let's move it there, and once we use the go-sdk, it will be resolved and easier to replace
LaurentGoderre
force-pushed
the
fix-docker-dot-io
branch
from
00cbc7d to
3b90c7b
Compare
There was a problem hiding this comment.
Actionable comments posted: 2
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (2)
docker_auth.go(1 hunks)internal/core/images.go(1 hunks)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (3)
- GitHub Check: lint (modules/artemis) / lint: modules/artemis
- GitHub Check: lint (modules/azurite) / lint: modules/azurite
- GitHub Check: Analyze (go)
internal/core/images.go
Outdated
| // Make comparison case-insensitive and handle both aliases | ||
| if strings.EqualFold(registry, "docker.io") || strings.EqualFold(registry, "registry.hub.docker.com") { | ||
| return fallback | ||
| } |
There was a problem hiding this comment.
🧩 Analysis chain
Implementation correctly addresses the authentication issue.
The case-insensitive alias check properly handles both docker.io and registry.hub.docker.com, ensuring they map to the canonical registry address for credential lookup. This resolves the original issue where Docker Hub images failed authentication.
Please verify whether other Docker Hub aliases like registry-1.docker.io also require similar handling:
🏁 Script executed:
#!/bin/bash
# Description: Check if registry-1.docker.io is referenced in the codebase or tests
echo "=== Searching for registry-1.docker.io references ==="
rg -n -C3 'registry-1\.docker\.io' --type go
echo -e "\n=== Checking Docker documentation and common registry patterns ==="
# Check if there are other registry patterns in use
rg -n -C2 'docker\.io|registry.*docker' --type go -g '!*vendor*' | head -30Length of output: 1740
🌐 Web query:
Docker registry aliases docker.io registry-1.docker.io index.docker.io registry.hub.docker.com
💡 Result:
Short answer: those hostnames are different DNS names/endpoints for Docker Hub (the Docker registry). registry-1.docker.io is the primary Docker Registry (v2) endpoint used by the Docker client; index.docker.io / index.docker.io/v1 refer to the older index/v1 API (legacy); docker.io is the short/default registry name (the client expands it to the Hub registry); hub.docker.com / registry.hub.docker.com are the web UI and related hostnames for Docker Hub. All are effectively different hostnames that point to Docker Hub’s registry services (not separate registries). [1][2][3][5]
Details (concise):
- docker.io — the default/short registry name used by the Docker client (maps to Docker Hub). [2][3]
- registry-1.docker.io — the Docker Hub image registry API endpoint (v2) that docker pull/push talk to. [5][2]
- index.docker.io — legacy “index” (v1) API / historical name; seen in older tooling and some auth/token flows. Prefer registry-1.docker.io for current registry API. [1][5]
- hub.docker.com / registry.hub.docker.com — the Docker Hub website/API-facing hostnames (web UI and related services); hub.docker.com is the site you visit in a browser. [6][1]
If you need URLs for auth/token flows or configuring container runtimes (containerd, etc.), use registry-1.docker.io as the registry endpoint. [5][7]
Sources:
[1] Docker Docs — What is a registry? (Docker Hub is the default registry).
[2] Blog / documentation notes on docker.io / registry hostnames.
[3] StackOverflow and community answers describing registry-1.docker.io vs index.docker.io.
[5] StackOverflow / how-to answers recommending registry-1.docker.io for v2 API.
Add missing Docker Hub registry aliases: registry-1.docker.io and index.docker.io
The current implementation only handles docker.io and registry.hub.docker.com, but is missing the primary Docker Registry v2 endpoint registry-1.docker.io (used by docker pull/push and other registry operations) and the legacy index.docker.io (v1 API). Without these aliases, image authentication will fail when users reference these endpoints directly.
Update the alias check to include:
registry-1.docker.io(primary v2 registry endpoint)index.docker.io(legacy v1 API, for compatibility)
🤖 Prompt for AI Agents
In internal/core/images.go around lines 103 to 106, the registry alias check
only handles "docker.io" and "registry.hub.docker.com" but must also treat
"registry-1.docker.io" and "index.docker.io" as Docker Hub aliases; update the
conditional to include those two values (using the same case-insensitive
EqualFold checks or consolidating into a small list/set and checking membership)
so the function returns the fallback for any of the four recognized Docker Hub
registry names.
3b90c7b to
326fd77
Compare
3 participants
What does this PR do?
When doing a Docker pull on an image with the default registry
docker.io, the auth helper doesn't match the image to the authentication data stored by the engine underhttps://index.docker.io/v1causing the error:credentials not found in native keychainWhy is it important?
This is important to support the default registry prefix.
How to test this PR
Unit test added