Documentation
¶
Overview ¶
Package dockercfg decodes a Docker registry credential config into the registries it authenticates to and the credential each entry carries.
Docker registry creds turn up constantly in loot: `~/.docker/config.json` on developer and CI hosts, the legacy `.dockercfg`, and — most consequentially — the Kubernetes `kubernetes.io/dockerconfigjson` image-pull secret, whose decoded payload is exactly this format. A registry credential with push access is a supply-chain primitive (publish a malicious image tag), so when one turns up the questions are which registries it reaches, what username it authenticates as, and whether the credential is embedded (usable as-is) or delegated to a credential helper (`credHelpers` / `credsStore`, which needs the operator's own login).
No confidently-wrong output: this reports the registry, username, and credential *shape* — it does NOT emit the decoded password (presence is flagged, the secret is not echoed), never contacts a registry, and never asserts the credential is live. Input that is not a recognisable Docker config is rejected rather than guessed at.
Wrap-vs-native: native — encoding/json + encoding/base64 over the documented Docker config schema (github.com/docker/cli config/configfile + types/auth); no new go.mod dependency.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Registry ¶
type Registry struct {
Registry string `json:"registry"`
Username string `json:"username,omitempty"`
// HasPassword is true when the auth field decoded to a user:password pair
// (the password itself is never emitted).
HasPassword bool `json:"has_password"`
// IdentityToken is true when the entry carries an OAuth2 identity token
// (a refresh token) rather than (or in addition to) a password.
IdentityToken bool `json:"identity_token"`
// CredHelper names a per-registry credential helper, if set (the credential
// is stored externally, not in this file).
CredHelper string `json:"cred_helper,omitempty"`
// Malformed flags an auth field that was present but did not base64-decode
// to a user:password pair.
Malformed bool `json:"malformed,omitempty"`
}
Registry is one registry credential entry.
type Result ¶
type Result struct {
// Format is "config.json" (modern) or "dockercfg-legacy".
Format string `json:"format"`
// CredsStore is the global credential helper, if set (external store).
CredsStore string `json:"creds_store,omitempty"`
Registries []Registry `json:"registries"`
// HasEmbeddedCredentials is true when any entry carries an in-file
// credential (password or identity token), as opposed to only helpers.
HasEmbeddedCredentials bool `json:"has_embedded_credentials"`
Note string `json:"note"`
}
Result is the decoded Docker config.
Source Files