docker config auths reverse engineering

.docker/config.json auths secrets

Before we start, backup ~/.docker/config.json and export DOCKER_CONFIG=~/.docker.

We will be using sh.

We should now have an empty $DOCKER_CONFIG/config.json.

If you are on Mac OS X like me, after we issue some docker login command we should be able to spot a credsStore attribute in our docker config.json:

        "credsStore": "desktop"

or even

        "credsStore": "osxkeychain"

Let's make sure we remove that attribute. docker login will now warn us that the authorizations values will be stored unencrypted:

WARNING! Your password will be stored unencrypted in ~/.docker/config.json.

For example if we issue a docker login ... with a service account on google cloud

docker login -u _json_key --password-stdin https://europe-west1-docker.pkg.dev  < ~/.gcp/sa-secret.json

We would also spot auths attribute with a base64 encoded string value.

{
        "auths": {
                "europe-west1-docker.pkg.dev": {
                        "auth": "BASE64ENCODEDxxxx",
        //...
}

We can use docker-credential-helpers from docker credentials release
to retrieve that "auth" value.

For example with docker-credential-osxkeychain release:

echo europe-west1-docker.pkg.dev | docker-credential-osxkeychain get

{
  "ServerURL": "europe-west1-docker.pkg.dev",
  "Username": "_json_key",
  "Secret": {
    // ...
  }
}

We would finally find that in $DOCKER_CONFIG/config.json the base64 encoded value is nothing else than

_json_key:{
   // ... value retrieved from docker-credential-oskeychain
}

But not that this is not rigorous JSON where we would had "_json_key":{}.

I haven't gone further but let's take it further if we find the right time.

Let's hope this gave you some ideas regarding your daily or uncommon routines. Let us know if you found that useful ;-)

See also

Docker credentials store
IAM Predefined roles
Kind Private Registries
StackOverflow "How to get value from docker-credential-osxkeychain"