Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: Don't populate X-Registry-* headers when credentials are not set #430

Merged
merged 4 commits into from
Jul 18, 2024

Conversation

eplightning
Copy link
Contributor

@eplightning eplightning commented Jul 17, 2024

Currently bollard unconditionally sends credentials (X-Registry-*) headers to Docker API, even when credentials are not specified (None is passed). For example request for image pull will look like this, despite having no specified credentials:

POST /images/create?fromImage=...&fromSrc=&repo=&tag=&platform= HTTP/1.1\r
x-registry-auth: eyJ1c2VybmFtZSI6bnVsbCwicGFzc3dvcmQiOm51bGwsImF1dGgiOm51bGwsImVtYWlsIjpudWxsLCJzZXJ2ZXJhZGRyZXNzIjpudWxsLCJpZGVudGl0eXRva2VuIjpudWxsLCJyZWdpc3RyeXRva2VuIjpudWxsfQ==\r
content-type: application/json\r
host: ...\r

(the base64 decoded auth is {"username":null,"password":null,"auth":null,"email":null,"serveraddress":null,"identitytoken":null,"registrytoken":null})

For Podman doing so causes it use those "empty" credentials instead of the default system ones, breaking functionality like registry mirrors and so on.

This PR does a small refactoring and sets this header to be empty when they are not specified, bringing it closer to behavior of other Docker libraries (empty or not set).

@eplightning
Copy link
Contributor Author

eplightning commented Jul 17, 2024

Hmm any idea why Windows tests try to push the image without any credentials?
I'm not sure if that makes sense but I have absolutely no experience with Windows.

I suppose we could do what Java does and explictly mark push call as requiring authentication and send empty object in that case: https://github.com/docker-java/docker-java/blob/a1393bf2e1265ba1e6eca4240af55396852f8a7c/docker-java-core/src/main/java/com/github/dockerjava/core/exec/AbstrDockerCmdExec.java#L75

@eplightning eplightning changed the title fix: Don't send X-Registry-* headers when credentials are not set fix: Don't populate X-Registry-* headers when credentials are not set Jul 17, 2024
@fussybeaver
Copy link
Owner

Great! Thank you..

@fussybeaver fussybeaver merged commit 49d38ba into fussybeaver:master Jul 18, 2024
14 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants