Buildkit: Login to a private registry using command line arguments

[Monnoroch]

Right now the dockerfile.v0 frontend reads the docker config file. This means I either need to generate it using docker login, or manually, which is not great.

Perhaps I just didn't find the flag, but this is what README.md says as well.

[tonistiigi]

@AkihiroSuda Any suggestions?

Overall we should move away from the text files and use os keychain logic. It would be easy to provide a script for this well.

[Monnoroch]

docker login has cli arguments -u XX -p YY. Why not support the same thing?

[xsbreakaway]

The same problem.
What should I do now? To login to my private registry by buidlctl without run "docker login".
OS:centos7.2

[AkihiroSuda]

img login can be used as well as docker login

It should be also easy to port over img login to buildctl https://github.com/genuinetools/img/blob/master/login.go

[walbertus]

Does this issue still relevant? Would like to try implementing this
For buildkit, -u and -p should not create or store credentials, right?
It only used for a single execution by storing it as variables in authprovider, is this approach correct?

[tonistiigi]

buildkit can access multiple registries for a single build so if we are talking about cli flags that would fill in authprovider they need to be a combination of host+user+pw/token .

[walbertus]

It doesn't need to store the credentials into file or os keychain right?
For handling multiple registries, how do you suggest the flags would look like?
We can use multiple --username, --host and --password or using comma separated

[chang-andrew]

Hi there, @walbertus are you still working on this issue? If not, would it be alright if I tried to take on this issue with a group of fellow students from UT Austin? We are taking a Virtualization class and would like to contribute to this issue, as it's a part of our course requirement.

[walbertus]

@chang-andrew Please go ahead

[Xplouder]

@chang-andrew Any progress?
@tonistiigi Is there any kind of workaround for this until it is implemented?

Thank you.

[tuananh]

@chang-andrew Any progress?
@tonistiigi Is there any kind of workaround for this until it is implemented?

Thank you.

you can create secret and mount it. buildkit will pick it up

[Xplouder]

@tuananh can you provide a snippet?

[tuananh]

You can do docker login from any machine. Then create secret from that
docker config json. Then mount it in buildkit container

On Sun, 20 Dec 2020 at 08:26 João Silva [e-mail] wrote:

@tuananh https://github.com/tuananh can you provide a snippet?

—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
https://github.com/moby/buildkit/issues/565#issuecomment-748549074, or
unsubscribe
https://github.com/notifications/unsubscribe-auth/AAEZETVQCR7U2WMYIWIVZ6DSVVHDPANCNFSM4FOSR6IQ
.

[maxwellb]

You can do docker login from any machine. Then create secret from that docker config json. Then mount it in buildkit container

Does this create a requirement that the frontend image is only local? I would like to be able to specify a syntax image from a private registry:

# syntax=privateregistry.example/ns/repo:1.2
FROM alpine
# ...

How can I mount this secret in the buildkit container so that it has access to privateregistry.example? Docker in docker?

[maxwellb]

Stating this as a separate concern, but motivation for the above:

With docker registry pull limits, it becomes difficult to adopt new frontend syntaxes if the act of building the image (even targeting a private registry or local) is throttled.