Documentation
¶
Overview ¶
Package registryauth reads registry credentials from the Docker client configuration, as the docker CLI does: static "auths" entries in config.json, and the credential-helper protocol (docker-credential-<name> get) for "credsStore" and "credHelpers". NewWithoutHelpers reads the same configuration without running a helper, and Static holds credentials that the caller supplies.
Credentials are read on demand and held in memory only. A credential helper's output never reaches the process output or an error, so that a misbehaving helper cannot put a secret into a log.
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ErrHelpersDisabled = errors.New("credential helpers are disabled")
ErrHelpersDisabled is the error for a host whose credentials a credential helper answers, from a Store that runs no helpers.
Functions ¶
This section is empty.
Types ¶
type Credentials ¶
type Credentials struct {
Username string
Password string
// IdentityToken is an OAuth2 refresh token, used instead of
// Username and Password to obtain registry tokens.
IdentityToken string
// RegistryToken is a bearer token sent to the registry as is.
RegistryToken string
}
Credentials authenticate to one registry. The zero value is anonymous.
func (Credentials) Anonymous ¶
func (c Credentials) Anonymous() bool
Anonymous reports whether c holds no credentials.
type Static ¶
type Static map[string]Credentials
Static holds fixed credentials keyed by registry host, for example "ghcr.io" or "127.0.0.1:5000". It reads no configuration and runs no program. A host it does not hold is anonymous, so an empty Static is anonymous for every registry. "docker.io", "index.docker.io", "registry-1.docker.io" and "https://index.docker.io/v1/" all name Docker Hub, as they do for a Store.
func (Static) Credentials ¶
func (s Static) Credentials(host string) (Credentials, error)
Credentials returns the credentials held for the registry host. An exact key wins; otherwise a Docker Hub host takes the first Docker Hub key present, in the order of dockerHubHosts.
type Store ¶
type Store struct {
// contains filtered or unexported fields
}
Store resolves credentials from one Docker client configuration directory. The configuration is read on first use. A nil Store is anonymous for every registry.
func FromEnvironment ¶
func FromEnvironment() *Store
FromEnvironment returns the Store for the Docker client configuration the docker CLI uses: $DOCKER_CONFIG/config.json, or ~/.docker/config.json when DOCKER_CONFIG is unset.
func New ¶
New returns the Store for the config.json in dir. An empty dir selects the directory FromEnvironment uses, read when the Store is first used.
func NewWithoutHelpers ¶
NewWithoutHelpers returns a Store like New that never runs a credential helper. It reads DOCKER_AUTH_CONFIG and the static auths of config.json. A host that credHelpers or credsStore assigns to a helper fails with ErrHelpersDisabled, as a failing helper fails: its static auths entry, if any, is not used, because the docker CLI would not use it either.
func (*Store) Credentials ¶
func (s *Store) Credentials(host string) (Credentials, error)
Credentials returns the credentials for the registry host (for example "ghcr.io", "127.0.0.1:5000" or "registry-1.docker.io"). A host with no configured credentials is anonymous.
Source Files