Current Docker Compose container is outdated; newer versions won't work with Docker for Mac

[rnorth]

• We currently have docker/compose:1.8.0 as the default image we use for running Docker Compose. This image is quite outdated and doesn't support compose format v3 for example.
• Attach user's Docker config folder to compose containers for proper authentication. #537 introduced a good general change - volume mounting in the user's ~/docker/config.json to allow access to registry credentials

This currently works with Compose 1.8.0, but upon reconfiguring TC to use a more recent version of Compose (e.g. 1.18.0) on Docker for Mac, compose will complain that the docker-credential-osxkeychain was not on the PATH.

The reason for this is that, with modern Docker for Mac, ~/docker/config.json references the docker-credential-osxkeychain credential helper. This is fine to be used by docker/other tools running on the Mac, as they can find and execute the helper on the path. However, the compose container has no such helper installed.

To fix fully, it seems to me that we would need a way for the compose container to invoke the credential helper on the Mac side - however this would be technically fiddly and would need to be done extremely carefully so as not to create a security risk.

A shorter-term workaround is to disable Docker for Mac's Securely store docker logins in macOS keychain. This is obviously fairly undesirable. However, this seems to be the only way to successfully use a more up to date Docker compose image.

[kiview]

Another (hackish) workaround would be to not mount ~/docker/config.json on OSX if the configured credential store is docker-credential-osxkeychain. As far as I understand, this would not break existing functionality, since the old compose container also wouldn't work with docker-credential-osxkeychain either.

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. If you believe this is a mistake, please reply to this comment to keep it open. If there isn't one already, a PR to fix or at least reproduce the problem in a test case will always help us get back on track to tackle this.

[stale]

This issue has been automatically closed due to inactivity. We apologise if this is still an active problem for you, and would ask you to re-open the issue if this is the case.