Recently I was frustrated in a Jenkins build when I was running Docker-in-Docker to build and push a container to AWS Elastic Container Registry (ECR).
The error on push was a familiar `no basic auth credentials` which means some issue with the credentials stored in
~/.docker/config.cfg (or perhaps
~/.dockercfg in earlier versions).
In this case I initially couldn’t understand the error, as the Jenkins declarative pipeline was using a
docker.withRegistry function for the registry login, and this was being successfully written to, so what was going on?
Eventually it occurred to me, although it’s not obvious at first – as we’re running docker-in-docker, you might assume that the credentials are looked for relative to where the Docker daemon is running (i.e. on the host), but actually it’s being looked for relative to where the client is calling the daemon from. In this case – within the container. The
docker.withRegistry that I was doing with Jenkins was creating credentials on the host – not within the container where the client itself was running.
There were two possible solutions here – one is to ensure you run the docker login command within the client context of the docker-in-docker container, or to mount the
.docker directory on the host into the container using something like `-v /root/.docker:/root/.docker` depending on what user you’re running your containers as.