ImageFromDockerfile does not support authenticated pulls

[rnorth]

ImageFromDockerfile doesn't work if base layer(s) need to be pulled from an authenticated registry and if those images are not already pulled.

For example:

# Dockerfile
FROM my.authenticated.registry/somerepo/someimage

will result in a failure at image build time, even if the user has working credentials available on their machine (for example, a CLI docker pull or docker build works).

It looks like BuildImageCmd's withBuildAuthConfigs(AuthConfigurations); gives us an opportunity to improve this - however we'd have to perform a lookup for credentials for each image first.

I think it should be feasible to:

• do a minimal parse of the Dockerfile to extract any FROM x [--as=y] declarations
• run each image name found through RegistryAuthLocator and obtain an auth configuration for each registry
• provide the auth configurations to BuildImageCmd

The main difficulty would be that we have a few different ways in which the Dockerfile flows through Testcontainers, so we'd need to make sure we capture Dockerfile content at the right time.

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. If you believe this is a mistake, please reply to this comment to keep it open. If there isn't one already, a PR to fix or at least reproduce the problem in a test case will always help us get back on track to tackle this.

[stale]

This issue has been automatically closed due to inactivity. We apologise if this is still an active problem for you, and would ask you to re-open the issue if this is the case.

[rnorth]

Reopening, as this is still an annoyance.

[rnorth]

Discovered a bug in 1.14.0's release of #2201. I'll follow up with a patch fix shortly.

[tazle]

So, the overall solution in TestContainers appears to to parse the Dockerfile and pre-pull.

We have some image builds that take the base image as build arg, and the current parsing doesn't account for that. For docker configurations without credsStore, the builds still work for us (probably because something in the TestContainers global docker client injects the X-Auth-Config information to the build POST request, but we haven't actually verified that yet).

I think I understand why the pre-pull route is necessary for docker-compose, but could there be an option to disable it for the normal case?

Overall idea is to add an option to: 1) Disable pre-pull, 2) pass all the available credentials to the build command.

The alternative, to support base-image-as-build-args, would be to parse build args. Do you think that approach would be better?

[erohana]

what is the status of this bug ?
as I'm experiencing this issue in my build after I'm using my company's ECR from base image