Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

client/dockerhub: return a ready-to-use Docker Hub credential (username, expiry, expired-session error, Desktop connect)

Aperta
  • Qualcosa non va?
#682 1 commento 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
35/100
Tipo di issue
Funzionalità
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Stack tecnologico
docker, go
Ambito
api, authentication

Direzione di ricerca

Start with client/dockerhub/dockerhub.go, where GetDefaultSession, UserSession, Claims and NumericDate live, and check the GetDefaultProfile lookup it already performs. Then look at client.New and api.DesktopSocketPath() in the x module to see how Desktop is reached. Done means the API decision on the proposed Credential type and its errors is agreed, with tests covering username, expiry and expired-session cases.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Summary

Docker Compose now uses Docker Desktop's Docker Hub session (via client/dockerhub) to authenticate pulls. To get a credential it can actually use, Compose had to write about 120 lines on top of the SDK. Most of that code isn't specific to Compose. Any consumer that wants "the signed-in user's Docker Hub credential" (the CLI, buildx, other tools) would have to write the same thing. This issue lists what client/dockerhub (checked at client/v0.1.2 and main) is missing, with links to the Compose code that fills each gap.

Compose implementation: internal/registry/desktop.go

1. GetDefaultSession does not give you a username

A registry credential needs a username. containerd treats a password with no username as a refresh token. UserSession.Claims.Username is often empty, so Compose has to call GetDefaultProfile again:

https://github.com/docker/compose/blob/e22de3b57415ea7bc3ddc6ce6ae2f547ea66993b/internal/registry/desktop.go#L186-L199

session, err := s.hub.GetDefaultSession(ctx)
// ...
username := session.Claims.Username
if username == "" {
	profile, err := s.hub.GetDefaultProfile(ctx) // second round trip
	// ...
	username = profile.Username
}
if username == "" {
	return ..., errNoUsername
}

Internally, GetDefaultSession already loads the default profile to find the account entry, then discards it. So callers pay for two profile lookups.

Ask: return the username, or the whole profile, with the session. For example, add Profile/Username to UserSession, or provide a dedicated call (see the proposal below).

2. No token expiry helper

To know how long a token can be reused, Compose reads Claims.ExpiresAt. If that is missing, it decodes the JWT payload itself and reuses dockerhub.NumericDate to parse exp:

https://github.com/docker/compose/blob/e22de3b57415ea7bc3ddc6ce6ae2f547ea66993b/internal/registry/desktop.go#L217-L240

func sessionExpiry(session dockerhub.UserSession) (time.Time, bool) {
	if exp := session.Claims.ExpiresAt; exp != nil {
		return exp.Time, true
	}
	return jwtExpiry(session.AccessToken) // split, base64-decode, unmarshal {"exp"}
}

The package already owns Claims and NumericDate, and documents that "Claims are zero when the payload carries none". Parsing the token belongs there.

Ask: func (s UserSession) ExpiresAt() (time.Time, bool), and/or fill in Claims from the JWT when the stored payload leaves them out.

3. An expired session is returned as if it were valid

GetDefaultSession returns a stored token even after it has expired (for example, the user signed out or Desktop hasn't refreshed it). Every caller has to check the expiry itself and define its own error:

https://github.com/docker/compose/blob/e22de3b57415ea7bc3ddc6ce6ae2f547ea66993b/internal/registry/desktop.go#L201-L208

var errSessionExpired = errors.New("the session has expired (not signed in to Docker Desktop?)")
// ...
if expiresAt, ok := sessionExpiry(session); ok {
	validUntil = expiresAt.Add(-sessionExpirySkew)
	if !now.Before(validUntil) {
		return ..., errSessionExpired
	}
}

Ask: a dockerhub.ErrSessionExpired that wraps ErrNoSession, returned for expired tokens, ideally with a configurable clock-skew margin.

4. No single way to check "no usable session"

To decide between falling back quietly to other credentials and warning the user, Compose checks three unrelated errors:

https://github.com/docker/compose/blob/e22de3b57415ea7bc3ddc6ce6ae2f547ea66993b/internal/registry/desktop.go#L242-L252

func isSessionUnavailable(err error) bool {
	return errors.Is(err, seclient.ErrSecretsEngineNotAvailable) ||
		errors.Is(err, dockerhub.ErrNoSession) ||
		errors.Is(err, errSessionExpired)
}

Ask: with (3) in place, document a single check for this case (e.g. errors.Is(err, dockerhub.ErrNoSession) also covering "engine not available"), or provide a helper such as dockerhub.IsUnavailable(err).

5. Connecting to Desktop requires the unstable x module

The client.New doc says "To connect to Docker Desktop, use WithSocketPath(api.DesktopSocketPath())". But api lives in github.com/docker/secrets-engine/x, so a stable-client consumer has to depend on x just to find the socket:

https://github.com/docker/compose/blob/e22de3b57415ea7bc3ddc6ce6ae2f547ea66993b/internal/registry/desktop.go#L86-L95

c, err := seclient.New(
	seclient.WithSocketPath(api.DesktopSocketPath()), // github.com/docker/secrets-engine/x/api
	seclient.WithTimeout(desktopLookupTimeout),
)
return c.HubAuth(opts...), nil

Ask: client.WithDesktopSocket() / client.NewDesktop(...), or re-export DesktopSocketPath from client.

6. (Optional) A caching, retrying credential source

Compose also wraps the lookup with a cache: one shared lookup for concurrent pulls, token reuse until it nearly expires, and a backoff after failures so it doesn't hit a hung or absent Desktop on every pull:

https://github.com/docker/compose/blob/e22de3b57415ea7bc3ddc6ce6ae2f547ea66993b/internal/registry/desktop.go#L132-L169

This is generic too. A wrapper such as dockerhub.NewCachedAuth(auth, opts...) would be useful, but it is the most debatable item if the SDK wants to stay stateless.

Proposal

Items 1–3 together could be one call that returns what a registry client needs:

type Credential struct {
	Username    string
	AccessToken string
	ExpiresAt   time.Time // zero if unknown
}

// GetDefaultCredential returns the default account's credential. It returns
// ErrNoDefaultProfile / ErrNoSession when nobody is signed in, and
// ErrSessionExpired (wrapping ErrNoSession) when the stored token has expired.
GetDefaultCredential(ctx context.Context) (Credential, error)

With that, plus (4) and (5), the Compose side shrinks to building a types.AuthConfig from Credential. jwtExpiry, sessionExpiry, errNoUsername, errSessionExpired, isSessionUnavailable, the second profile lookup and the dependency on x/api would all go away. The matching Compose tests (TestJWTExpiry, …ExpiryFromTokenWhenClaimsLackIt, …UsernameFromProfile, TestIsSessionUnavailable) would move here.

Happy to send PRs for any of these.

Lingua principale
Go
Stelle
95
Fork
18
Merge medio
7h 52m
PR unite (30g)
31

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di docker/secrets-engine

Tutte le issue di docker/secrets-engine

Issue simili

Altre issue su Go

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.