docker hub container_pull failing with auth error after upgrades

[jmhodges]

With bazel 0.23 and docker 2.0.0.3 (stable) on macOS 10.14.3, my previously working container_pulls of docker hub images are failing with an odd error:

$  bazel build --verbose_failures @mysql//...
ERROR: Pull command failed: F0302 20:29:21.091686    8129 __main__.py:106] Error resolving credentials for index.docker.io/library/mysql@sha256:8c15b2612051244d0a2b6ceb6f9bf82ddc0e909555c1067c098e5f935e2751a7: Unsupported entry in "auth" section of Docker config: {}

That's with the below container_pull and happens with both rules_docker's current HEAD 0d355f1, and the much older 85450d2.

container_pull(
    name = "mysql",
    registry = "index.docker.io",
    repository = "library/mysql",
    # digest for tag 5.7.25 on 2019-02-28
    digest = "sha256:8c15b2612051244d0a2b6ceb6f9bf82ddc0e909555c1067c098e5f935e2751a7",
)

in my WORKSPACE. This also happens with a postgres image I have in there. My manual docker pulls work just fine for these images.

This is, unfortunately, a fresh machine and I can't figure out what else might have changed.

[nlopezgi]

you might need to setup auth in your new machine? https://github.com/bazelbuild/rules_docker/blob/master/README.md#authentication
if that does not work let me know

[jmhodges]

But these are public repositories on Docker Hub? Those docs are for private repos from Azure and GCP, yeah?

I don’t see any info on how or why we’d need auth for public repos on Docker Hub

[nlopezgi]

hmm not sure what might be wrong in the setup. do you have some repro instructions?

[jmhodges]

Yeah, if you clone https://github.com/jmhodges/bazel_bugs and checkout the branch rules_docker_704, and run bazel query @mysql//... you might see the error I do.

That error is:

$  bazel query @mysql//...
ERROR: Pull command failed: F0303 20:43:51.538836   11381 __main__.py:106] Error resolving credentials for index.docker.io/library/mysql@sha256:8c15b2612051244d0a2b6ceb6f9bf82ddc0e909555c1067c098e5f935e2751a7: Unsupported entry in "auth" section of Docker config: {}
 (/usr/bin/python /private/var/tmp/_bazel_jeffhodges/657f25a25bbdcaca9e247ddc19e54e64/external/puller/file/downloaded --directory /private/var/tmp/_bazel_jeffhodges/657f25a25bbdcaca9e247ddc19e54e64/external/mysql/image --os linux --os-version  --os-features  --architecture amd64 --variant  --features  --name index.docker.io/library/mysql@sha256:8c15b2612051244d0a2b6ceb6f9bf82ddc0e909555c1067c098e5f935e2751a7)
Loading: 0 packages loaded
    Fetching @mysql; fetching

[jmhodges]

Here's the config.json that the fresh install of docker 2.0.0.3 gave me:

{
  "stackOrchestrator" : "swarm",
  "credSstore" : "osxkeychain",
  "auths" : {
    "https://index.docker.io/v1/" : {

    }
  }
}

[jmhodges]

Because I'm suspecting this is a containerregistry problem, I made a ticket over there: google/containerregistry#144

Can you repro with that config.json?

[jmhodges]

Ugh, yeah, replacing the auths section of the json with just "auths" : {} fixes the problem. Seems like there's just a new format containerregistry has to handle (I think).

[nlopezgi]

Thanks for debugging. We'll follow-up on the containerregistry issue to make sure it gets resolved promptly.

[jmhodges]

Thank you for working with me on this!

[jmhodges]

Ping!

[smukherj1]

Hi @jmhodges,

google/containerregistry is currently in maintenance mode and it's unlikely they'll implement a feature to support newer docker config formats. We are migrating rules_docker to go-containerregistry. I suggest trying

load("@io_bazel_rules_docker//container:new_pull.bzl", "new_container_pull")

new_container_pull(
    name = "mysql",
    registry = "index.docker.io",
    repository = "library/mysql",
    # digest for tag 5.7.25 on 2019-02-28
    digest = "sha256:8c15b2612051244d0a2b6ceb6f9bf82ddc0e909555c1067c098e5f935e2751a7",
)

I just tried this and it worked for me.

[jmhodges]

Thanks for the update! That worked!

I'll close this out