Documentation
¶
Overview ¶
Package hubauth mints Docker access tokens from the personal access token that `docker login` (including Docker Desktop's sign-in) leaves in the Docker CLI credential store.
Docker Desktop's backend API only ever hands out its own access token — valid for 15 minutes — and never the refresh token behind it, so callers cannot renew it: when Desktop's background refresher is stuck, every caller keeps getting the same expired JWT. The stored PAT is long-lived and Docker Hub exchanges it for a fresh token without any user interaction, which gives docker-agent a token source it controls.
The PAT never leaves this process except in the exchange request to Docker Hub: the endpoint is pinned to a Docker host, redirects are not followed, and account passwords are never sent.
Index ¶
Constants ¶
const ExpiryLeeway = 30 * time.Second
ExpiryLeeway is how long before its expiry a token stops being handed out: it covers the flight time of the request the token authenticates, plus the residual clock difference with the issuer.
Variables ¶
This section is empty.
Functions ¶
func Expiring ¶
Expiring reports whether the JWT's exp claim has passed or is less than ExpiryLeeway away, i.e. whether a fresh token should be obtained. Tokens that don't parse or carry no exp claim are left for the server to judge.
func Expiry ¶
Expiry returns the token's exp claim, or false when the token doesn't parse or carries no exp claim.
func Invalidate ¶
func Invalidate(token string)
Invalidate drops token from the cache, so the next Token call mints a new one. Called when Docker rejects a token we believed to be valid; a token that has since been replaced is left alone.
func Token ¶
Token returns a Docker token minted from the stored PAT, reusing the last one until it is about to expire. Callers get an error when no PAT is available (not signed in, or signed in with a password) or when Hub refuses the exchange.
Attempts are singleflighted and run detached from the caller — reading the credential store shells out to a helper that ignores cancellation, and the result serves everyone — so a caller whose context is canceled returns immediately without holding up the others.
Types ¶
type Identity ¶
Identity is the Docker account a token was issued for. Both Docker Desktop's tokens and the ones we mint carry it, which makes the account known without asking Docker Desktop — the only source docker-agent used to have.
func IdentityFromToken ¶
IdentityFromToken returns the account token was issued for, and false when the token carries no account information.
Source Files