Commit Graph

74 Commits

Author SHA1 Message Date
Sebastiaan van Stijn 4c3b87d922
config.Load() remove unneeded locks
These were added in b83bc67136, but
I'm not sure why I added these; they're likely not needed.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit 09ddcffb2f)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2021-04-01 12:04:57 +02:00
Sebastiaan van Stijn 4571d90f20
config: print deprecation warning when falling back to ~/.dockercfg
Relates to the deprecation, added in 3c0a167ed5

The docker CLI up until v1.7.0 used the `~/.dockercfg` file to store credentials
after authenticating to a registry (`docker login`). Docker v1.7.0 replaced this
file with a new CLI configuration file, located in `~/.docker/config.json`. When
implementing the new configuration file, the old file (and file-format) was kept
as a fall-back, to assist existing users with migrating to the new file.

Given that the old file format encourages insecure storage of credentials
(credentials are stored unencrypted), and that no version of the CLI since
Docker v1.7.0 has created this file, the file is marked deprecated, and support
for this file will be removed in a future release.

This patch adds a deprecation warning, which is printed if the CLI falls back
to using the deprecated ~/.dockercfg file.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit b83bc67136)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2021-03-08 17:21:15 +01:00
Sebastiaan van Stijn d513e46bfc
cli/config: prevent warning if HOME is not set
commit c2626a8270 replaced the use of
github.com/docker/docker/pkg/homedir with Golang's os.UserHomeDir().

This change was partially reverted in 7a279af43d
to account for situations where `$HOME` is not set.

In  situations where no configuration file is present in `~/.config/`, the CLI
falls back to looking for the (deprecated) `~/.dockercfg` configuration file,
which was still using `os.UserHomeDir()`, which produces an error/warning if
`$HOME` is not set.

This patch introduces a helper function and a global variable to get the user's
home-directory. The global variable is used to prevent repeatedly looking up
the user's information (which, depending on the setup can be a costly operation).

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit c85a37dbb4)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2021-02-04 14:38:27 +01:00
Tibor Vass 48d30b5b32 Use golang.org/x/sys/execabs
On Windows, the os/exec.{Command,CommandContext,LookPath} functions
resolve command names that have neither path separators nor file extension
(e.g., "git") by first looking in the current working directory before
looking in the PATH environment variable.
Go maintainers intended to match cmd.exe's historical behavior.

However, this is pretty much never the intended behavior and as an abundance of precaution
this patch prevents that when executing commands.
Example of commands that docker.exe may execute: `git`, `docker-buildx` (or other cli plugin), `docker-credential-wincred`, `docker`.

Note that this was prompted by the [Go 1.15.7 security fixes](https://blog.golang.org/path-security), but unlike in `go.exe`,
the windows path lookups in docker are not in a code path allowing remote code execution, thus there is no security impact on docker.

Signed-off-by: Tibor Vass <tibor@docker.com>
(cherry picked from commit 8d199d5bba)
Signed-off-by: Tibor Vass <tibor@docker.com>
2021-01-28 22:27:59 +00:00
Sebastiaan van Stijn 3f19902eae
Config-file: remove User-Agent from config.json when saving
The config.json allows for setting custom HTTP headers, but given that
User-Agent is not customizable, we should remove it from the config before saving;

Before this change;

    $ cat ~/.docker/config.json
    {
        "auths": {
            "https://index.docker.io/v1/": {
                "auth": "<base64 auth>"
            }
        },
        "HttpHeaders": {
            "User-Agent": "Docker-Client/19.03.12 (linux)"
        }
    }

    $ docker logout
    {
        "auths": {},
        "HttpHeaders": {
            "User-Agent": "Docker-Client/19.03.12 (linux)"
        }
    }

After this change:

    $ cat ~/.docker/config.json
    {
        "auths": {
            "https://index.docker.io/v1/": {
                "auth": "<base64 auth>"
            }
        },
        "HttpHeaders": {
            "User-Agent": "Docker-Client/19.03.12 (linux)"
        }
    }

    $ docker logout
    Removing login credentials for https://index.docker.io/v1/

    $ cat ~/.docker/config.json
    {
        "auths": {}
    }

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-10-01 15:04:39 +02:00
Sebastiaan van Stijn 75ab44af6f
Fix ConfigFile.Save() replacing symlink with file
In situations where `~/.docker/config.json` was a symlink, saving
the file would replace the symlink with a file, instead of updating
the target file location;

    mkdir -p ~/.docker
    touch ~/real-config.json
    ln -s ~/real-config.json ~/.docker/config.json

    ls -la ~/.docker/config.json
    # lrwxrwxrwx 1 root root 22 Jun 23 12:34 /root/.docker/config.json -> /root/real-config.json

    docker login
    # Username: thajeztah
    # Password:

    # Login Succeeded

    ls -la ~/.docker/config.json
    -rw-r--r-- 1 root root 229 Jun 23 12:36 /root/.docker/config.json

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-07-16 11:35:41 +02:00
Silvin Lubecki e4e754bb74
Merge pull request #2595 from cpuguy83/handle_close_error_on_save
Handle errors on close in config file write.
2020-07-15 17:40:10 +02:00
Silvin Lubecki cae16e70b9
Merge pull request #2599 from thaJeztah/ignore_empty_configfile
config: ignore empty config file instead of printing warning
2020-07-09 15:27:29 +02:00
Sebastiaan van Stijn 969580a887
config: ignore empty config file instead of printing warning
Before this change, a warning would be printed if the `~/.docker/config.json`
file was empty:

    mkdir -p ~/.docker && touch ~/.docker/config.json
    docker pull busybox
    WARNING: Error loading config file: /root/.docker/config.json: EOF
    Using default tag: latest
    ....

Given that we also accept an empty "JSON" file (`{}`), it should be
okay to ignore an empty file, as it's effectively a configuration file
with no custom options set.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-06-23 14:51:28 +02:00
Brian Goff d02173090f Handle errors on close in config file write.
I'm not sure if this fixes anything, however I have seen some weird
behavior on Windows where temp config files are left around and there
doesn't seem to be any errors reported.

Signed-off-by: Brian Goff <cpuguy83@gmail.com>
2020-06-19 11:26:30 -07:00
Sebastiaan van Stijn 89089fb419
config: remove redundant os.Stat()
There's no need to perform an `os.Stat()` first, because
`os.Open()` also returns the same errors if the file does
not exist, or couldn't be opened for other reasons.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-06-15 11:08:56 +02:00
Sebastiaan van Stijn 494f30a1a5
config: fix error message using incorrect filename
Before:

    echo 'invalid-json' > ~/.dockercfg
    docker pull hello-world
    WARNING: Error loading config file: /root/.docker/config.json: Invalid Auth config file

After:

    echo 'invalid-json' > ~/.dockercfg
    docker pull hello-world
    WARNING: Error loading config file: /root/.dockercfg: Invalid Auth config file

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-06-12 22:30:10 +02:00
Sebastiaan van Stijn bb7ef2cb3a
Update some uses of errors.Cause() to errors.Is()
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-05-10 19:56:35 +02:00
Sebastiaan van Stijn 8a30653ed5
config: don't call homedir on init()
This patch changes the package to lazily obtain the user's home-
directory on first use, instead of when initializing the package.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-04-21 17:25:22 +02:00
Sebastiaan van Stijn 19bcebd122
test: make sure environment vars are reset after tests
The trust tests were not resetting the environment after they
ran, which could result in tests following those tests to fail.

While at it, I also updated some other tests to use gotest.tools

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-04-09 13:40:45 +02:00
Sebastiaan van Stijn 2c0e93063b
bump gotest.tools v3.0.1 for compatibility with Go 1.14
full diff: https://github.com/gotestyourself/gotest.tools/compare/v2.3.0...v3.0.1

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-02-23 00:28:55 +01:00
Sebastiaan van Stijn e7f720b0a6
cli/config: fix formatting of comments
Comments should have a leading space unless the comment is
for special purposes (go:generate, nolint:)

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-01-16 12:47:49 +01:00
Sebastiaan van Stijn 22a291f703
config: preserve ownership and permissions on configfile
When running `docker login` or `docker logout`, the CLI updates
the configuration file by creating a temporary file, to replace
the old one (if exists).

When using `sudo`, this caused the file to be created as `root`,
making it inaccessible to the current user.

This patch updates the CLI to fetch permissions and ownership of
the existing configuration file, and applies those permissions
to the new file, so that it has the same permissions as the
existing file (if any).

Currently, only done for "Unix-y" systems (Mac, Linux), but
can be implemented for Windows in future if there's a need.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2019-12-17 09:57:33 +01:00
Sebastiaan van Stijn 612d83d6df
cli: remove unnecessary newlines (whitespace)
```
cli/config/config_test.go:465: unnecessary trailing newline (whitespace)

}
cli/compose/interpolation/interpolation.go:56: unnecessary leading newline (whitespace)
	switch value := value.(type) {

cli/compose/interpolation/interpolation.go:94: unnecessary trailing newline (whitespace)

	}
cli/command/image/build/context.go:348: unnecessary trailing newline (whitespace)

		}
internal/licenseutils/client_test.go:98: unnecessary leading newline (whitespace)
func (c *fakeLicensingClient) LoadLocalLicense(ctx context.Context, dclnt licensing.WrappedDockerClient) (*model.Subscription, error) {

cli/registry/client/fetcher.go:211: unnecessary leading newline (whitespace)
	for _, endpoint := range endpoints {
```

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2019-10-31 19:22:36 +01:00
Sebastiaan van Stijn 5a2a9d9ca8
cli/config: Using the variable on range scope `tc` in function literal (scopelint)
```
cli/config/config_test.go:590:11: Using the variable on range scope `tc` in function literal (scopelint)
			SetDir(tc.dir)
			       ^
cli/config/config_test.go:591:19: Using the variable on range scope `tc` in function literal (scopelint)
			f, err := Path(tc.path...)
			               ^
cli/config/config_test.go:592:23: Using the variable on range scope `tc` in function literal (scopelint)
			assert.Equal(t, f, tc.expected)
			                   ^
```

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2019-10-31 19:22:32 +01:00
Vincent Demeester a8ff7f8210
Merge pull request #2122 from jonjohnsonjr/passthrough-user-pass
Allow username/password in config file
2019-10-17 10:35:24 +02:00
Jon Johnson 8f11fbc876 Fix lint issue
Signed-off-by: Jon Johnson <jonjohnson@google.com>
2019-10-16 09:59:49 -07:00
Jon Johnson 415f608620 Add test case to cover non-empty auth entry
Signed-off-by: Jon Johnson <jonjohnson@google.com>
2019-10-16 09:54:19 -07:00
Tibor Vass 7a279af43d config: revert to using pkg/homedir
In c2626a82 homedir logic got extremely simplified to only
checking HOME environment variable on UNIX systems.

Although this should work well enough in traditional environments,
this could break minimal containerized environments.

This patch reverts to using github.com/docker/docker/pkg/homedir
that was recently updated to have less dependencies.

Signed-off-by: Tibor Vass <tibor@docker.com>
2019-10-07 21:05:58 +00:00
Jon Johnson 37e9cabf11 Allow username/password in config file
Signed-off-by: Jon Johnson <jonjohnson@google.com>
2019-10-02 12:55:27 -07:00
Tibor Vass 47f059db7a config: keep configDir empty when homedir errors
Signed-off-by: Tibor Vass <tibor@docker.com>
2019-09-24 23:48:59 +00:00
Tibor Vass c2626a8270 cli/config: use os.UserHomeDir instead of github.com/docker/docker/pkg/homedir
Signed-off-by: Tibor Vass <tibor@docker.com>
2019-09-23 23:27:52 +00:00
Tibor Vass 1ed02c40fe cli-plugins: alias an existing allowed command (only builder for now)
With this patch it is possible to alias an existing allowed command.
At the moment only builder allows an alias.

This also properly puts the build command under builder, instead of image
where it was for historical reasons.

Signed-off-by: Tibor Vass <tibor@docker.com>
2019-04-19 01:26:45 +00:00
Tibor Vass c3fc547cc9
Merge pull request #1712 from thaJeztah/fix_test_for_go_1.12
Fix test for Go 1.12.x
2019-03-13 13:38:57 -07:00
Nick Adcock ff51b0d77d harden config.Path() to disallow directory traversal
Signed-off-by: Nick Adcock <nick.adcock@docker.com>
2019-03-07 14:40:53 +00:00
Sebastiaan van Stijn d4877fb225
Fix test for Go 1.12.x
After switching to Go 1.12, the format-string causes an error;

```
=== Errors
cli/config/config_test.go:154:3: Fatalf format %q has arg config of wrong type *github.com/docker/cli/cli/config/configfile.ConfigFile
cli/config/config_test.go:217:3: Fatalf format %q has arg config of wrong type *github.com/docker/cli/cli/config/configfile.ConfigFile
cli/config/config_test.go:253:3: Fatalf format %q has arg config of wrong type *github.com/docker/cli/cli/config/configfile.ConfigFile
cli/config/config_test.go:288:3: Fatalf format %q has arg config of wrong type *github.com/docker/cli/cli/config/configfile.ConfigFile
cli/config/config_test.go:435:3: Fatalf format %q has arg config of wrong type *github.com/docker/cli/cli/config/configfile.ConfigFile
cli/config/config_test.go:448:3: Fatalf format %q has arg config of wrong type *github.com/docker/cli/cli/config/configfile.ConfigFile

DONE 1115 tests, 2 skipped, 6 errors in 215.984s
make: *** [Makefile:22: test-coverage] Error 2
Exited with code 2
```

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2019-03-04 20:19:14 +01:00
Ian Campbell 20439aa662 Simplify cli plugin config file entry
Make it a simple `map[string]string` for now.

Added a unit test for it.

Signed-off-by: Ian Campbell <ijc@docker.com>
2019-02-25 10:38:48 +00:00
Ian Campbell 4eb642be46 Add a field to the config file for plugin use.
This is a bit manual (as the unit test attests) so we may find we want to add
some helpers/accessors, but this is enough to let plugins use it and to
preserve the information through round-trips.

Signed-off-by: Ian Campbell <ijc@docker.com>
2019-02-25 10:38:48 +00:00
Tonis Tiigi 27b2797f7d Remove docker api dependency from cli/config
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Signed-off-by: Tibor Vass <tibor@docker.com>
2019-01-31 21:25:43 +00:00
Ian Campbell f1f31abbe5 Add support for running a CLI plugin
Also includes the  scaffolding for finding a validating plugin candidates.

Argument validation is moved to RunE to support this, so `noArgs` is removed.

Signed-off-by: Ian Campbell <ijc@docker.com>
2019-01-30 13:44:04 +00:00
Ian Campbell eab40a5974 cli/config: Add a helper to resolve a file within the config dir
Signed-off-by: Ian Campbell <ijc@docker.com>
2019-01-29 11:26:40 +00:00
Simon Ferquel b34f340346 Introduce docker context store
This PR adds a store to the CLI, that can be leveraged to persist and
retrieve credentials for various API endpoints, as well as
context-specific settings (initially, default stack orchestrator, but we
could expand that).

This comes with the logic to persist and retrieve endpoints configs
for both Docker and Kubernetes APIs.

Signed-off-by: Simon Ferquel <simon.ferquel@docker.com>
2019-01-04 17:06:51 +01:00
Benoit Sigoure 7e9e2c10bc cli/config/configfile: Atomically rewrite the config file when saving.
The config file was being truncated first, which created a window during
which it was empty, causing concurrent uses of the `docker` command to
potentially fail with:
  WARNING: Error loading config file: /var/lib/jenkins/.docker/config.json: EOF
  Error response from daemon: Get https://registry/v2/foo/manifests/latest: no basic auth credentials

Signed-off-by: Benoit Sigoure <tsunanet@gmail.com>
2018-09-10 13:43:24 -07:00
Vimal Raghubir ce3d069936
Fix: Warning Message
Signed-off-by: Vimal-Raghubir <vraghubir0418@gmail.com>
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2018-07-13 13:39:24 +02:00
Euan Kemp 056015c3d8 config/credentials: don't run 'pass' to detect it
'CheckInitialized' in the credential-helper library actually invokes
`pass`, which isn't desirable (see #699).

This moves the check to be simpler, and then pass will only be invoked
when it's needed (such as for `docker login` or when pulling from a
private registry).

This logic could also reasonably live in the credential-helper library,
but it's simple enough it seems fine in either location.

Signed-off-by: Euan Kemp <euank@euank.com>
2018-06-29 11:38:39 -07:00
Vincent Demeester d9741fc96b
Update docker-credential-helpers dependency
This is mainly for the `pass` helper ; `pass` shouldn't be called
every docker command anymore ;).

Signed-off-by: Vincent Demeester <vincent@sbr.pm>
2018-06-28 14:44:53 +02:00
Silvin Lubecki 71272dd203
Scope orchestration selection to stack commands only
* Renaming DOCKER_ORCHESTRATOR to DOCKER_STACK_ORCHESTRATOR
* Renaming config file option "orchestrator" to "stackOrchestrator"
* "--orchestrator" flag is no more global but local to stack command and subcommands
* Cleaning all global orchestrator code
* Replicating Hidden flags in help and Supported flags from root command to stack command

Signed-off-by: Silvin Lubecki <silvin.lubecki@docker.com>
2018-06-21 17:12:31 -07:00
Vincent Demeester 2c4de4fb5e
Update tests to use gotest.tools 👼
Signed-off-by: Vincent Demeester <vincent@sbr.pm>
2018-06-08 18:24:26 +02:00
Silvin Lubecki fb34ffc327 Check allNamespace config value while loading configuration file
Signed-off-by: Silvin Lubecki <silvin.lubecki@docker.com>
2018-05-28 15:15:25 +02:00
Mathieu Champlon 1c1300bef6 Imply all Kubernetes namespaces for docker stack list when orchestrator is all or Kubernetes
* Add "kubernetes" struct in config file with "allNamespaces" option, to opt-out this behavior when set as "disabled"

Signed-off-by: Mathieu Champlon <mathieu.champlon@docker.com>
2018-05-28 10:43:32 +02:00
Vincent Demeester 4290df3958 print a big warning about cleartext passwords
Signed-off-by: Tycho Andersen <tycho@docker.com>
2018-03-26 16:18:32 +02:00
Daniel Nephin baf65a5502 Convert to assert.NilError
Using:

  git grep -l '^\s\+assert\.Check(t, err)$' | \
    xargs sed -i -e 's/^\(\s\+assert\)\.Check(t, err)$/\1.NilError(t, err)/'

Signed-off-by: Daniel Nephin <dnephin@docker.com>
2018-03-06 15:27:34 -05:00
Daniel Nephin 681c921528 Remove testutil
Signed-off-by: Daniel Nephin <dnephin@docker.com>
2018-03-06 14:38:35 -05:00
Daniel Nephin 789acb526c Cleanup config load error handling
Signed-off-by: Daniel Nephin <dnephin@docker.com>
2018-03-06 13:44:06 -05:00
Daniel Nephin 7c8b5708eb Don't set a default filename for ConfigFile
With a default filename tests will leave a file in the working directory
that is never cleaned up.

Signed-off-by: Daniel Nephin <dnephin@docker.com>
2018-03-06 13:32:50 -05:00