Google Git
Sign in
chromium / external / github.com / GoogleCloudPlatform / docker-credential-gcr / v1.4.3
commit4cc7a4b6ef28e79ea9f2c708bcb02f8e93c6aec0[log] [tgz]
authorJake Sanders <1200829+dekkagaijin@users.noreply.github.com>Sat Feb 10 04:48:32 2018
committerGitHub <noreply@github.com>Sat Feb 10 04:48:32 2018
tree4452451db4a3091ad49fcaefb18d3192a5b1ef5c
parentcff6d48b2913e90316b56363228037480f6a8d56 [diff]
1.4.3 release
1 file changed
tree: 4452451db4a3091ad49fcaefb18d3192a5b1ef5c
  1. auth/
  2. cli/
  3. config/
  4. credhelper/
  5. store/
  6. test/
  7. util/
  8. vendor/
  9. .gitignore
  10. .travis.yml
  11. BUILD.bazel
  12. CONTRIBUTING.md
  13. LICENSE
  14. main.go
  15. Makefile
  16. README.md
  17. WORKSPACE
README.md

docker-credential-gcr Build Status Go Report Card

Introduction

docker-credential-gcr is Google Container Registry‘s Docker credential helper. It allows for Docker clients v1.11+ to easily make authenticated requests to GCR’s repositories (gcr.io, eu.gcr.io, etc.).

The helper implements the Docker Credential Store API, but enables more advanced authentication schemes for GCR's users. In particular, it respects Application Default Credentials and is capable of generating credentials automatically (without an explicit login operation) when running in App Engine or Compute Engine.

GCR Credentials

By default, the helper searches for GCR credentials in the following order:

  1. In a JSON file whose path is specified by the GOOGLE_APPLICATION_CREDENTIALS environment variable.
  2. In a JSON file in a location known to the helper. On Windows, this is %APPDATA%/gcloud/application_default_credentials.json. On other systems, $HOME/.config/gcloud/application_default_credentials.json.
  3. On Google App Engine it uses the appengine.AccessToken function.
  4. On Google Compute Engine and Google App Engine Managed VMs, it fetches credentials from the metadata server.
  5. From the gcloud SDK (i.e. the one printed via gcloud config config-helper --force-auth-refresh --format='value(credential.access_token)').
  6. In the helper's private credential store (i.e. those stored via docker-credential-gcr gcr-login)

However, the user may limit or re-order how the helper searches for GCR credentials using docker-credential-gcr config --token-source. Numbers 1-4 above are designated by the “env” source, 5 by “gcloud” and 6 by “store”. Multiple sources are separated by commas, and the default is “env, gcloud, store”.

Examples:

To configure the credential helper to use only the gcloud SDK's access token:

docker-credential-gcr config --token-source="gcloud"

To try the private store, followed by the environment:

docker-credential-gcr config --token-source="store, env"

To verify that credentials are being returned for a given registry, e.g. for https://gcr.io:

echo "https://gcr.io" | docker-credential-gcr get

Other Credentials

The helper implements the Docker Credential Store API and can be used to store credentials for other repositories. WARNING: Credentials are stored in plain text in a file under the user's home directory (e.g. $HOME/.config/gcloud/docker_credentials.json on non-windows systems).

Building from Source

The program in this repository is written with the Go programming language and built with make. These instructions assume that Go 1.7+ and make are installed on a *nix system.

  1. Download the source and put it in your $GOPATH with go get.

    go get github.com/GoogleCloudPlatform/docker-credential-gcr

  2. Use make to build the program. The executable will be output to the bin directory inside the repository.

    cd $GOPATH/src/github.com/GoogleCloudPlatform/docker-credential-gcr
make

  3. Put that binary in your $PATH. e.g. if /usr/bin is present on your path:

    sudo mv ./bin/docker-credential-gcr /usr/bin/docker-credential-gcr

Installation and Usage

  • Configure the Docker CLI to use docker-credential-gcr as its credential store

    docker-credential-gcr configure-docker
    • Alternatively, use the instructions below to configure your version of the Docker client.

  • Log in to GCR (or don't! gcloud auth login is sufficient, too)

    docker-credential-gcr gcr-login

  • Use Docker!

    docker pull gcr.io/project-id/neato-container

  • Log out from GCR

    docker-credential-gcr gcr-logout

Docker Clients v1.13(.0-rc4)+ Manual Installation

Add a credHelpers entry in the Docker config file (usually ~/.docker/config.json) for each GCR registry that you care about. The key should be the domain of the registry (without the “https://”) and the key chould be the suffix of the credential helper binary (everything after “docker-credential-”).

e.g. for `docker-credential-gcr`:

Docker Clients v1.11 - v1.12 Manual Installation

Set the credsStore and auths fields in your Docker config file (usually ~/.docker/config.json). credsStore should be the suffix of the compiled binary (everything after “docker-credential-”) and auths should have an empty entry for each GCR endpoint that you care about (with the “https://”).

e.g. for `docker-credential-gcr`:

License

Apache 2.0. See LICENSE for more information.