Hacktoberfest 2026：メンテナが10月に向けて印を付けた、オープンで初心者向けの issue。 Hacktoberfest の issue を見る

Allow login credentials for specific repo/scope

オープン
  • 何か問題がありますか？
#6,695 コメント 0 件 リアクション 1 件 担当者 0 名 GitHub で見る

メンテナーはふだん 1 日以内に返信

まだ誰も着手していません。

評価

難易度
5/5
見積もり時間
1週間以上
初心者へのやさしさ
25/100
issue の種類
機能追加
明瞭さ
説明が足りない
活発さ
停滞
技術スタック
docker, go
領域
authentication, cli, security

調査の方向性

cli/config/types/authconfig.go から始め、registry リクエストに使用する AuthConfig の認証情報がどのように保存および参照されるかを追跡します。repository/scope キー形式を、提案されている構造化された認証情報モデルと比較し、credential-helper との互換性も含めます。プロジェクトで、最も具体的な認証情報を選択するための合意済みの設計と、定義済みの移行または後方互換性の方針が得られれば完了です。

索引モデルが issue の本文から書いたものです。

説明

kind/feature status/0-triage
Description

Currently, it is only possible to store one set of credentials/token for a registry domain. Defined in AuthConfig https://github.com/docker/cli/blob/v29.1.2/cli/config/types/authconfig.go#L4 .

The request is to expand this so that separate credentials can be set for a specific repository and token scope.

Use-cases
  • Some registries support credentials that are scoped to specific repositories. This is better for security and should be encouraged. In build, it is currently impossible to use such credentials when build can pull multiple repositories. In docker push (or build —push) same issue appears when using cross-repo mount. If the push token was only scoped to the target repository, it does not have access to the source repository from which the layer was originally pulled. Additionally, you would always need to reset the credentials between each command.
  • Registry can have rate limiting based on credentials. Currently, when push credentials are presented to push the build result, these credentials are also used for the pull requests for the same registry. This may change the rate-limiting calculation and make builds fail. For example, in GitHub Actions, the default credentials for public read-only access have high rate limits, but when a user switches them to their own credentials in order to make push work, they may get much lower limits.
Option 1:

Switch the definition of string key for AuthConfig map from domain name to:

domain[/repo/path][:scope1,scope2]

When querying credentials, the library would filter out all the matching ones and then pick the most specific match (first by repo, then by scope).

While microformat is somewhat hacky, this method would allow at least some of the credential helpers to continue working without modification. The cloud provider credential helpers (GCP, Azure) probably do parse the domain name from the key.

Option 2:

As the credentials are defined in a map, it makes avoiding the microformat tricky. We can add Repository []string, Scope []string to the AuthConfig struct, but we would also need to change the container from a map to an array. For backwards compatibility and upgrades, updating the type might be beneficial, though. We could also not replace the map but add smth like repoAuths []AuthConfig that is only used when repo or scope are specified.

This would still mean that credential helpers wouldn’t work by default. Or if we still use the microformat for the registry helper key, then maybe some will work, but it is hard to be sure. We would probably need to redefine the credential helper interface, and at least some of the credential helpers would need to be updated.

This is not strictly related to the request above, but if this work results in a major refactoring of the credentials system, it probably makes sense to find a new home for this code where the Docker credential support can be easily imported into other projects, rather than needing to import the docker/cli repository.

主要言語
Go
スター
6.1k
フォーク
2.2k
平均マージ
1日 11時間
マージ済み PR（30日）
45

環境構築

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

docker/cli のほかの issue

docker/cli の issue をすべて見る

似ている issue

Go の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。