Docker login fails returning "The stub received bad data" on Windows when using awscli v2.

[overbit]

Confirm by changing [ ] to [x] below to ensure that it's a bug:

• I've gone though the User Guide and the API reference
• I've searched for previous similar issues and didn't find any solution

Describe the bug
Authenticate Docker to an Amazon ECR registry with get-login-password fails with the following error:
Error saving credentials: error storing credentials - err: exit status 1, out: 'The stub received bad data.'

SDK version number
aws-cli/2.0.56 Python/3.7.7 Windows/10 exe/AMD64

Platform/OS/Hardware/Device
Windows 10 1909
Docker Desktop 2.4.0

To Reproduce (observed behavior)

1. Have an ECR repository setup
2. Authenticate docker to pull and push images from the repository using the authorization token:
   aws ecr get-login-password --region <specific-region> | docker login --username AWS --password-stdin <myaccount>.dkr.ecr. <specific-region>.amazonaws.com

Expected behavior
Login should be successful

Additional context
I'm currently using an aws profile configured with AWS SSO

aws ecr get-login-password --region <specific-region> command alone succeed returning a token.
This token might be too big for docker login to accept?

[paulriley]

I ran into the same problem. Reverting to Docker Desktop 2.3.0.5 made it go away, so I think this must be a new problem with 2.4.0.0.

[kdaily]

Thanks for the report. A quick look around shows a StackOverflow post and the same error with the Azure CLI with this scenario, and a (potentially insecure) solution:

• az acr login failure Azure/azure-cli#4843
• https://stackoverflow.com/questions/60807697/get-ecrlogincommand-and-docker-login-error-storing-credentials-the-stub-receiv

Looking at the post from the Azure CLI, it was addressed on the server side by limiting the token length. I'll pass this information on to the ECR team for review, as I don't think it's something that the CLI can address directly.

[maurera]

I have the same issue, also using AWS SSO

Workaround attempts:

• I tried uninstalling Docker Desktop 2.4.0.0 and installing version 2.3.0.5, as suggested by @paulriley . This was unsuccessful.
• I tried the answer to the stackoverflow question posted by @kdaily (modifying .docker\config.json and separately, deleting docker-credential-wincred.exe and docker-credential-desktop.exe). This was unsuccessful.

As it stands, I'm still unable to push to ecr

[maurera]

I just had a call with AWS support. As far as I understand it, when you run aws ecr get-login, you're requesting a string authentication token from AWS (IAM under the hood). There's no limit on the length of this string, but it's typically shorter than 2500 characters.

When you run docker login... it uses Windows Credentials Manager, which doesn't support secrets of greater than 2,500 characters (see AWS support thread here: https://forums.aws.amazon.com/thread.jspa?threadID=324928). The AWS ECR guys blame AWS IAM and AWS IAM blames Windows.

With that said, we found a workaround, by using amazon-ecr-credential-manager, which seems to override Windows Credentials Manager under the hood. Follow the instructions here https://github.com/awslabs/amazon-ecr-credential-helper. This has the added benefit of automating the aws ecr get-login step, so you can go straight from you docker tag step to docker push step.

[overbit]

@maurera Thanks for the help. Unfortunately, it doesn't seem that amazon-ecr-credential-manager supports AWS SSO at the moment.
awslabs/amazon-ecr-credential-helper#229

[kdaily]

Hi @maurera, thanks for passing along that information. I'm going to mark this as a potential update for our documentation troubleshooting section.

Sorry that the solution provided doesn't work for you, @overbit. You can add in a comment on the issue you linked.

[maurera]

FYI - the ECR Credential helper initially helped in my case, but now I get the following error after running docker push:

denied: Your authorization token has expired. Reauthenticate and try again

[kdaily]

Hi @maurera, sorry to hear that. This seems like an issue with the credential helper, so I would suggest following up in their repository.

[maurera]

Note - I tried two workarounds.

First (didn't work). I launched a WSL2 Ubuntu Linux instance and tried aws ecr get-login-password from there. This didn't work (it seems like it's still connecting with the docker engine running in Windows, which connects to Windows Credential Manager.)

Second (works). I spun up an EC2 instance, copied over my project, and docker pushd from there.

This seems like a major issue. People who develop in Windows can't push Docker containers to AWS right now.