[JENKINS-38018] withDockerRegistry fails to authenticate with DockerHub

Type: Bug
Resolution: Fixed
Priority: Minor
Component/s: docker-commons-plugin, docker-workflow-plugin
Labels:
None
Environment:
Jenkins 2.7.3, docker-workflow 1.7

Similar Issues:
Powered by SuggestiMate

Show

When using either docker.withRegistry('', 'dockerhub') or withDockerRegistry(registry: [credentialsId: 'dockerhub']), a call to mycont.push() fails to authenticate with DockerHub:

  withDockerRegistry(registry: [credentialsId: 'dockerhub']) {
    cont.push()
    cont.push('latest')
  }

leads to:

Proceeding
[Pipeline] withDockerRegistry
[Pipeline] {
[Pipeline] sh
[test] Running shell script
+ docker tag --force=true camptocamp/jenkins-test camptocamp/jenkins-test:latest
unknown flag: --force
See 'docker tag --help'.
+ docker tag camptocamp/jenkins-test camptocamp/jenkins-test:latest
[Pipeline] sh
[test] Running shell script
+ docker push camptocamp/jenkins-test:latest
The push refers to a repository [docker.io/camptocamp/jenkins-test]
749689370cd8: Preparing
unauthorized: authentication required
[Pipeline] }
[Pipeline] // withDockerRegistry
[Pipeline] }
[Pipeline] // node
[Pipeline] End of Pipeline

I have the credentials set up properly in Jenkins, as shown in the attached screenshot, but Jenkins Credentials Manager says `This credential has not been recorded as used anywhere.`

- - Sort By Name
  - Sort By Date
  - Ascending
  - Descending
  - Thumbnails
  - List
  - Download All

Screenshot from 2016-09-07 11-11-27.png
49 kB
2016-09-07 09:11

is blocked by

JENKINS-51395 withDockerRegistry([...]) syntax no longer accepted

Resolved

JENKINS-51397 docker login being called without server-related environment variables

Resolved

is duplicated by

JENKINS-41051 withRegistry is not doing a "docker login"

Resolved

JENKINS-48458 Multiple jobs running in parallel on the same agent using the Docker Workflow Plugin withRegistry results in overwritten credentials

Resolved

JENKINS-32022 Auth hash for .docker/config.json is not correct format in jenkins 1.6+

Resolved

is related to

JENKINS-34958 Getting "Your Authorization Token has expired" when using ECR credentials

Resolved

JENKINS-44143 ECR plugin: no basic auth credentials

Closed

JENKINS-45851 Your Authorization Token is invalid.

Closed

relates to

JENKINS-33985 Credentials always points to https://index.docker.io/v1 even for private registry

Resolved

JENKINS-51406 Integrate with new docker login APIs

Open

JENKINS-51407 Integrate with new docker login APIs

Open

JENKINS-51949 Docker agent in declarative pipeline failing to login to custom registry

Open

JENKINS-28702 Clean up registry credentials

Resolved

JENKINS-46321 JSONException: null object when 'auths' key is not exist in .docker/config.json file.

Resolved

links to

CloudBees Internal CD-316

CloudBees Internal OSS-2612

docker-commons PR 55

docker-commons PR 67

docker-workflow PR 71

docker-workflow PR 72

docker-workflow PR 133

mentioned in: Page Loading...; Page Loading...

(3 is related to, 6 relates to, 7 links to, 2 mentioned in)

Raphaël PINSON created issue - 2016-09-07 09:12

Raphaël PINSON made changes - 2016-09-07 09:14

Description

Original: When using either `docker.withRegistry('', 'dockerhub')` or `withDockerRegistry(registry: [credentialsId: 'dockerhub'])`, a call to `mycont.push()` fails to authenticate with DockerHub:

{code:groovy}
  withDockerRegistry(registry: [credentialsId: 'dockerhub']) {
    cont.push()
    cont.push('latest')
  }
{code}

leads to:

{code:logs}
Proceeding
[Pipeline] withDockerRegistry
[Pipeline] {
[Pipeline] sh
[test] Running shell script
+ docker tag --force=true camptocamp/jenkins-test camptocamp/jenkins-test:latest
unknown flag: --force
See 'docker tag --help'.
+ docker tag camptocamp/jenkins-test camptocamp/jenkins-test:latest
[Pipeline] sh
[test] Running shell script
+ docker push camptocamp/jenkins-test:latest
The push refers to a repository [docker.io/camptocamp/jenkins-test]
749689370cd8: Preparing
unauthorized: authentication required
[Pipeline] }
[Pipeline] // withDockerRegistry
[Pipeline] }
[Pipeline] // node
[Pipeline] End of Pipeline
{code}

I have the credentials set up properly in Jenkins, as shown in the attached screenshot, but Jenkins Credentials Manager says `This credential has not been recorded as used anywhere.`

New: When using either {{docker.withRegistry('', 'dockerhub')}} or {{withDockerRegistry(registry: [credentialsId: 'dockerhub'])}}, a call to {{mycont.push()}} fails to authenticate with DockerHub:

{code:groovy}
  withDockerRegistry(registry: [credentialsId: 'dockerhub']) {
    cont.push()
    cont.push('latest')
  }
{code}

leads to:

{code:logs}
Proceeding
[Pipeline] withDockerRegistry
[Pipeline] {
[Pipeline] sh
[test] Running shell script
+ docker tag --force=true camptocamp/jenkins-test camptocamp/jenkins-test:latest
unknown flag: --force
See 'docker tag --help'.
+ docker tag camptocamp/jenkins-test camptocamp/jenkins-test:latest
[Pipeline] sh
[test] Running shell script
+ docker push camptocamp/jenkins-test:latest
The push refers to a repository [docker.io/camptocamp/jenkins-test]
749689370cd8: Preparing
unauthorized: authentication required
[Pipeline] }
[Pipeline] // withDockerRegistry
[Pipeline] }
[Pipeline] // node
[Pipeline] End of Pipeline
{code}

I have the credentials set up properly in Jenkins, as shown in the attached screenshot, but Jenkins Credentials Manager says `This credential has not been recorded as used anywhere.`

Raphaël PINSON made changes - 2016-09-07 09:16

Description

Original: When using either {{docker.withRegistry('', 'dockerhub')}} or {{withDockerRegistry(registry: [credentialsId: 'dockerhub'])}}, a call to {{mycont.push()}} fails to authenticate with DockerHub:

{code:groovy}
  withDockerRegistry(registry: [credentialsId: 'dockerhub']) {
    cont.push()
    cont.push('latest')
  }
{code}

leads to:

{code:logs}
Proceeding
[Pipeline] withDockerRegistry
[Pipeline] {
[Pipeline] sh
[test] Running shell script
+ docker tag --force=true camptocamp/jenkins-test camptocamp/jenkins-test:latest
unknown flag: --force
See 'docker tag --help'.
+ docker tag camptocamp/jenkins-test camptocamp/jenkins-test:latest
[Pipeline] sh
[test] Running shell script
+ docker push camptocamp/jenkins-test:latest
The push refers to a repository [docker.io/camptocamp/jenkins-test]
749689370cd8: Preparing
unauthorized: authentication required
[Pipeline] }
[Pipeline] // withDockerRegistry
[Pipeline] }
[Pipeline] // node
[Pipeline] End of Pipeline
{code}

I have the credentials set up properly in Jenkins, as shown in the attached screenshot, but Jenkins Credentials Manager says `This credential has not been recorded as used anywhere.`

New: When using either {{docker.withRegistry('', 'dockerhub')}} or {{withDockerRegistry(registry: [credentialsId: 'dockerhub'])}}, a call to {{mycont.push()}} fails to authenticate with DockerHub:

{code:java}
  withDockerRegistry(registry: [credentialsId: 'dockerhub']) {
    cont.push()
    cont.push('latest')
  }
{code}

leads to:

{code:logs}
Proceeding
[Pipeline] withDockerRegistry
[Pipeline] {
[Pipeline] sh
[test] Running shell script
+ docker tag --force=true camptocamp/jenkins-test camptocamp/jenkins-test:latest
unknown flag: --force
See 'docker tag --help'.
+ docker tag camptocamp/jenkins-test camptocamp/jenkins-test:latest
[Pipeline] sh
[test] Running shell script
+ docker push camptocamp/jenkins-test:latest
The push refers to a repository [docker.io/camptocamp/jenkins-test]
749689370cd8: Preparing
unauthorized: authentication required
[Pipeline] }
[Pipeline] // withDockerRegistry
[Pipeline] }
[Pipeline] // node
[Pipeline] End of Pipeline
{code}

I have the credentials set up properly in Jenkins, as shown in the attached screenshot, but Jenkins Credentials Manager says `This credential has not been recorded as used anywhere.`

Raphaël PINSON made changes - 2016-09-07 09:17

Description

Original: When using either {{docker.withRegistry('', 'dockerhub')}} or {{withDockerRegistry(registry: [credentialsId: 'dockerhub'])}}, a call to {{mycont.push()}} fails to authenticate with DockerHub:

{code:java}
  withDockerRegistry(registry: [credentialsId: 'dockerhub']) {
    cont.push()
    cont.push('latest')
  }
{code}

leads to:

{code:logs}
Proceeding
[Pipeline] withDockerRegistry
[Pipeline] {
[Pipeline] sh
[test] Running shell script
+ docker tag --force=true camptocamp/jenkins-test camptocamp/jenkins-test:latest
unknown flag: --force
See 'docker tag --help'.
+ docker tag camptocamp/jenkins-test camptocamp/jenkins-test:latest
[Pipeline] sh
[test] Running shell script
+ docker push camptocamp/jenkins-test:latest
The push refers to a repository [docker.io/camptocamp/jenkins-test]
749689370cd8: Preparing
unauthorized: authentication required
[Pipeline] }
[Pipeline] // withDockerRegistry
[Pipeline] }
[Pipeline] // node
[Pipeline] End of Pipeline
{code}

I have the credentials set up properly in Jenkins, as shown in the attached screenshot, but Jenkins Credentials Manager says `This credential has not been recorded as used anywhere.`

New: When using either {{docker.withRegistry('', 'dockerhub')}} or {{withDockerRegistry(registry: [credentialsId: 'dockerhub'])}}, a call to {{mycont.push()}} fails to authenticate with DockerHub:

{code:java}
  withDockerRegistry(registry: [credentialsId: 'dockerhub']) {
    cont.push()
    cont.push('latest')
  }
{code}

leads to:

{code:none}
Proceeding
[Pipeline] withDockerRegistry
[Pipeline] {
[Pipeline] sh
[test] Running shell script
+ docker tag --force=true camptocamp/jenkins-test camptocamp/jenkins-test:latest
unknown flag: --force
See 'docker tag --help'.
+ docker tag camptocamp/jenkins-test camptocamp/jenkins-test:latest
[Pipeline] sh
[test] Running shell script
+ docker push camptocamp/jenkins-test:latest
The push refers to a repository [docker.io/camptocamp/jenkins-test]
749689370cd8: Preparing
unauthorized: authentication required
[Pipeline] }
[Pipeline] // withDockerRegistry
[Pipeline] }
[Pipeline] // node
[Pipeline] End of Pipeline
{code}

I have the credentials set up properly in Jenkins, as shown in the attached screenshot, but Jenkins Credentials Manager says `This credential has not been recorded as used anywhere.`

Raphaël PINSON added a comment - 2016-09-07 14:49

Nevermind, the user I was using didn't have rights to push to that repository… Sorry for the noise, everything works.

Raphaël PINSON added a comment - 2016-09-07 14:49 Nevermind, the user I was using didn't have rights to push to that repository… Sorry for the noise, everything works.

Raphaël PINSON made changes - 2016-09-07 14:49

Resolution		New: Fixed [ 1 ]
Status	Original: Open [ 1 ]	New: Resolved [ 5 ]

Raphaël PINSON added a comment - 2016-09-13 13:58

Actually, it still doesn't work. It worked because I had used the following code at some point:

    withCredentials([[$class: 'UsernamePasswordMultiBinding', credentialsId: 'dockerhub',
        usernameVariable: 'USERNAME', passwordVariable: 'PASSWORD']]) {
      sh 'docker login -u "$USERNAME" -p "$PASSWORD"'
      cont.push()
    }

and it didn't remove the credentials, so switching to `withDockerRegistry()` after that used the credentials still stored in `~/.docker`.

I've just experienced that `withDockerRegistry()` on clean slaves doesn't work, and had to revert to using `withCredentials()`.

Raphaël PINSON added a comment - 2016-09-13 13:58 Actually, it still doesn't work. It worked because I had used the following code at some point: withCredentials([[$class: 'UsernamePasswordMultiBinding' , credentialsId: 'dockerhub' , usernameVariable: 'USERNAME' , passwordVariable: 'PASSWORD' ]]) { sh 'docker login -u "$USERNAME" -p "$PASSWORD" ' cont.push() } and it didn't remove the credentials, so switching to `withDockerRegistry()` after that used the credentials still stored in `~/.docker`. I've just experienced that `withDockerRegistry()` on clean slaves doesn't work, and had to revert to using `withCredentials()`.

Raphaël PINSON made changes - 2016-09-13 13:58

Resolution	Original: Fixed [ 1 ]
Status	Original: Resolved [ 5 ]	New: Reopened [ 4 ]

Nathan Hüsken added a comment - 2016-09-21 13:25

+1, I have the same problem

Nathan Hüsken added a comment - 2016-09-21 13:25 +1, I have the same problem

Jesse Glick added a comment - 2016-09-29 14:16 - edited

withRegistry continues to work in the stock demo (using registry:0.9.1) but perhaps DockerHub changed their authentication mechanism? Need to check if this is reproducible from scratch.

Jesse Glick added a comment - 2016-09-29 14:16 - edited withRegistry continues to work in the stock demo (using registry:0.9.1 ) but perhaps DockerHub changed their authentication mechanism? Need to check if this is reproducible from scratch.

Assignee:: Jesse Glick

Reporter:: Raphaël PINSON

Votes:: 16 Vote for this issue

Watchers:: 35 Start watching this issue

Created:: 2016-09-07 09:12

Updated:: 2018-07-20 19:59

Resolved:: 2018-05-17 19:41

Jenkins

Details

Description

Attachments

Attachments

Issue Links

Activity

Collapse comment: Raphaël PINSON added a comment - 2016-09-07 14:49

Expand comment: Raphaël PINSON added a comment - 2016-09-07 14:49

Collapse comment: Raphaël PINSON added a comment - 2016-09-13 13:58

Expand comment: Raphaël PINSON added a comment - 2016-09-13 13:58

Collapse comment: Nathan Hüsken added a comment - 2016-09-21 13:25

Expand comment: Nathan Hüsken added a comment - 2016-09-21 13:25

Collapse comment: Jesse Glick added a comment - 2016-09-29 14:16, Edited by Jesse Glick - 2016-09-29 14:17

Expand comment: Jesse Glick added a comment - 2016-09-29 14:16, Edited by Jesse Glick - 2016-09-29 14:17

People

Dates