httpOci gives '401 on reattempt after auth: https://registry.gitlab.com/' #675
Comments
|
Thanks for sharing the detailed trace logs. To help debug this, would you be able to create a gitlab PAT manually (ensuring the permissions are permissive enough to push/pull from the gitlab registry) and use that in instead of I'm admittedly not too familiar with gitlab registry auth, it may be an issue in the CLI's implementation here. edit: following https://docs.gitlab.com/ee/user/packages/container_registry/authenticate_with_container_registry.html |
|
I created a PAT with all permissions granted and tried using that instead, but got the same error. I made this change, and had saved the PAT in a CI variable --- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -21,7 +21,7 @@ deploy:
rules:
- if: $CI_COMMIT_REF_NAME == $CI_DEFAULT_BRANCH
script:
- - echo "${CI_REGISTRY_PASSWORD}" | docker login ${CI_REGISTRY} --username ${CI_REGISTRY_USER} --password-stdin
+ - echo "${PERSONAL_ACCCESS_TOKEN}" | docker login ${CI_REGISTRY} --username ${GITLAB_USER_LOGIN} --password-stdin
# - cat ~/.docker/config.json
# - export DEVCONTAINERS_OCI_AUTH="${CI_REGISTRY}|${CI_REGISTRY_USER}|${CI_REGISTRY_PASSWORD}"
# - echo ${DEVCONTAINERS_OCI_AUTH}Docker could still login using the PAT, and as before httpOci found auth details in config.json but failed. |
|
Thanks! Every registry seems to do auth a little differently (a lot follow a specification set out by docker, but nearly every registry i've seen so far has some exception). We're implementing this ourselves in the CLI so we need to account for these differences. I think we'll need to dig in more to understand the differences. Afterwards a regression test can be placed here to ensure continued support: https://github.com/devcontainers/cli/blob/main/src/test/container-features/registryCompatibilityOCI.test.ts#L40-L69 |
|
Upon closer review, it looks like GitLab does not yet support the arifacts specification required to publish dev container Features. I'd recommend raising an issue with gitlab, or instead publishing your Features to one of the many registries that do currently support the spec (Google CR, GitHub CR, Azure CR, docker hub, etc...) Please do re-open this if/when the support is implemented by gitlab :) |
|
@joshspicer can you detail or link the information you reviewed that led you to conclude that Gitlab did not support the required Artifacts Specification? I can use this as part of opening an issue with Gitlab. |
|
The "oras" project I linked above outlines all the implementors. I couldn't find any evidence online that this data is out-of-date, please correct me if i'm wrong: https://oras.land/docs/compatible_oci_registries#registries-supporting-oci-artifacts |
|
I found https://gitlab.com/gitlab-org/gitlab/-/issues/385277 that requests that GitLab add support for OCI artifacts |
|
I guess https://containers.dev/guide/gitlab-ci should be marked as not working/supported (assuming it ever did), and linked to this issues. |
This guide is for publishing a dev container config into a docker image hosted on gitlab CR (which does work, doesn't need the OCI aritfacts spec implemented as it's a standard docker image with some custom labels). What I saw you trying to do here was publish Features, which is different and does requires that spec. |
|
(For any future readers) I think that this issue may still be valid (we may need to do a little fixing of the auth implementation to support gitlab), but doing so today would provide no value without the container registry supporting the aforementioned spec |
While trying to follow the 'Working with GitLab CI' example at: https://containers.dev/guide/gitlab-ci
using this GitLab pipeline definition:
I get the following 401 auth error from httpOci. As can be seen from the commented out additional line and addition of
--log-level traceI tried to determine if there was problem. But unfortunately it's not obvious to me why the 401 is happening. The docker login succeeded, and httpOci reports finding auth docker populated in/root/.docker/config.jsonWhy would httpOci fail to auth and get a 401 here? Any suggestions on further debugging/logging to attempt?
The text was updated successfully, but these errors were encountered: