docker login returns "error getting credentials - err: exit status 1 ..."

Question

docker login returns "error getting credentials - err: exit status 1 ..."

BradleyA opened this issue 8 years ago · 52 comments

The docker login command is returning the following error for two users out of three users on the same physical host using docker-credential-secretservice Release v0.5.0. The user that can login to docker hub does not have any issue pushing or pulling. All users have the same docker environment variable settings, path, file permissions and content for $HOME/.docker/config.json, run the same shell /bin/bash, same .profile and .bashrc. All users were able to connect to Docker Hub before installing docker-credential-secretservice.
When I delete the $HOME/.docker/config.json file from a user that is receiving the error message, the user continues receiving the same error message when entering docker login until I removed /usr/local/bin/docker-credential-secretservice from the host. Then the user can login to docker hub without the use of docker-credential-secretservice without any incident. It is like docker is looking for docker-credential-secretservice in the PATH before it is checking $HOME/.docker/config.json to see if the user is going to use it. If this assumption is correct then there would be a line added to docker.log unless the error is coming from something docker is calling. Either way what is creating the error message, error getting credentials - err: . . .?
When I re-download and install docker-credential-secretservice onto the host in /usr/local/bin the user again receives the error message. If I remove /usr/local/bin/docker-credential-secretservice but leave $HOME/.docker/config.json as shown below I receive an error that I would expect; error getting credentials - err: exec: "docker-credential-secretservice": executable file not found in $PATH, out: ``

$ docker login
error getting credentials - err: exit status 1, out: Error spawning command line 'dbus-launch --autolaunch=d7159335070ef1c0854c75de55c8f588 --binary-syntax --close-stderr': Child process exited with code 1

Any help will be appreciated:

Expected all users on the same physical host to receive a login prompt from docker hub.

This incident is also effecting other accounts on other hosts (running Docker 17.04.0-ce, 17.05.0-ce-rc2, and 1.13.1) with similar but different error messages
$ docker login
error getting credentials - err: exit status 127, out: ``

$ cat $HOME/.docker/config.json
{
"auths": {},
"credsStore": "secretservice"
}

$ ls -l $HOME/.docker/config.json
-rw------- 1 uadmin uadmin 49 Apr 29 08:20 /home/uadmin/.docker/config.json

$ echo $PATH
/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin

$ ls -l /usr/local/bin/docker-credential-secretservice
-rwxr-xr-x 1 root root 2382344 Mar 14 05:20 /usr/local/bin/docker-credential-secretservice

$ env | grep -i docker
DOCKER_HOST=tcp://three.cptx86.com:2376
DOCKER_TLS_VERIFY=1
PWD=/home/uadmin/.docker
DOCKER_CERT_PATH=/home/uadmin/.docker
DOCKER_CONTENT_TRUST=1

OS: Ubuntu 14.04.5 LTS

$ docker version
Client:
Version: 17.03.0-ce
API version: 1.26
Go version: go1.7.5
Git commit: 60ccb22
Built: Thu Feb 23 10:57:47 2017
OS/Arch: linux/amd64

Server:
Version: 17.03.0-ce
API version: 1.26 (minimum version 1.12)
Go version: go1.7.5
Git commit: 60ccb22
Built: Thu Feb 23 10:57:47 2017
OS/Arch: linux/amd64
Experimental: false

$ cat /etc/default/docker
DOCKER_OPTS="
--graph=/usr/local/docker
--dns 192.168.1.202
--dns 8.8.8.8
--dns 8.8.4.4
--host=hostname -f:2376
--label XHOST=hostname -f
--label XIPADDRESS=hostname -i
--label XOS=lsb_release -d | awk '{ print $2"-"$3"-"$4 }'
--label XRELEASE=docker version | grep -m 1 Version: | awk '{ print $2 }'
--label XSECURITY=namespace-control
--log-level warn
--log-driver=json-file
--log-opt max-size=5m
--log-opt max-file=7
--log-opt labels=host,ip,gateway,id
--tlsverify
--tlscacert=/etc/docker/certs.d/daemon/ca.pem
--tlscert=/etc/docker/certs.d/daemon/hostname -f-cert.pem
--tlskey=/etc/docker/certs.d/daemon/hostname -f-priv-key.pem
--userns-remap=default
"

$ docker info
Containers: 0
Running: 0
Paused: 0
Stopped: 0
Images: 2
Server Version: 17.03.0-ce
Storage Driver: aufs
Root Dir: /usr/local/docker/362144.362144/aufs
Backing Filesystem: extfs
Dirs: 2
Dirperm1 Supported: true
Logging Driver: json-file
Cgroup Driver: cgroupfs
Plugins:
Volume: local
Network: bridge host macvlan null overlay
Swarm: active
NodeID: 6hkwnobu6t374trqoaosx2wbg
Is Manager: true
ClusterID: fphwipe950p46noadhkzjci06
Managers: 1
Nodes: 1
Orchestration:
Task History Retention Limit: 5
Raft:
Snapshot Interval: 10000
Number of Old Snapshots to Retain: 0
Heartbeat Tick: 1
Election Tick: 3
Dispatcher:
Heartbeat Period: 5 seconds
CA Configuration:
Expiry Duration: 3 months
Node Address: 192.168.1.203
Manager Addresses:
192.168.1.203:2377
Runtimes: runc
Default Runtime: runc
Init Binary: docker-init
containerd version: 977c511eda0925a723debdc94d09459af49d082a
runc version: a01dafd48bc1c7cc12bdb01206f9fea7dd6feb70
init version: 949e6fa
Security Options:
apparmor
userns
Kernel Version: 4.4.0-75-generic
Operating System: Ubuntu 14.04.5 LTS
OSType: linux
Architecture: x86_64
CPUs: 8
Total Memory: 11.72 GiB
Name: three
ID: KIKV:2ITY:O5GF:5JEA:O5F6:GKKS:DYGG:NUMO:UTYK:B6ZR:OKB7:BECJ
Docker Root Dir: /usr/local/docker/362144.362144
Debug Mode (client): false
Debug Mode (server): false
Registry: https://index.docker.io/v1/
WARNING: No swap limit support
Labels:
XHOST=three.cptx86.com
XIPADDRESS=192.168.1.203
XOS=Ubuntu-14.04.5-LTS
XRELEASE=17.03.0-ce
XSECURITY=namespace-control
Experimental: false
Insecure Registries:
127.0.0.0/8
Live Restore Enabled: false

$ tail /var/log/upstart/docker.log
No error found in /var/log/upstart/docker.log

Daemon debug mode: The daemon output with debug set is the same for all three users.
$ tail /var/log/upstart/docker.log
time="2017-04-29T11:30:51.531218145-05:00" level=debug msg="Calling GET /_ping"
time="2017-04-29T11:30:51.531554559-05:00" level=debug msg="Calling GET /v1.26/info"

mauscoelho commented 7 years ago

+1

👎14

Answer 1 · 2017-09-01T01:10:56.000Z

any update?

Answer 2 · 2017-09-01T07:29:58.000Z

@runcom ^^

Answer 3 · 2017-09-11T08:56:26.000Z

The same situation before.
If you use iTerm 2 & macOS 10.13, please try command like 'sudo ls', it might be say "sudo: unknown uid 501: who are you", you can restart iTerm can resolve this problem.

Answer 4 · 2017-10-09T06:47:21.000Z

This solved my problem @cuiweiqiang.
I had the same issue as mentioned above. Thanks a lot!

Answer 5 · 2017-10-15T22:54:30.000Z

I had kind of similar issue, just remove
"credsStore": "secretservice" line from the docker config file, if you do not need it. Then the login should go smoothly. I found the answer here: #24

Answer 6 · 2017-11-16T08:09:02.000Z

after I update to Mac OS 10.13.1 (17B48) this problem appears and It solved by removing "credsStore":
from
~/.docker/config.json

Answer 7 · 2017-12-15T17:52:44.000Z

After removing credsStore in the config.json I got still an error. By disabling the checkbox "securely save docker logins in macOS keychain" in the docker preferences I could finally access my registry.

Answer 8 · 2018-01-03T21:26:29.000Z

mac OS 10.13.2
lunch keychaine access
right click login, lock then unlock
That's it!

Answer 9 · 2018-01-04T08:48:00.000Z

just lock and unlock again the KeyChain Acess in Mac

Answer 10 · 2018-01-22T04:20:12.000Z

@Dean-Christian-Armada solved

Answer 11 · 2018-01-26T19:12:42.000Z

I'll submit a fix to get the command to prompt the keychain password in order to unlock it if needed before trying to access elements.

Thanks for submitting the issue and the solution.

Answer 12 · 2018-05-17T18:07:43.000Z

For me I had to remove the package golang-docker-credential-helpers which somehow got installed on my headless Ubuntu 18.04 device. This package is installed with docker-compose.

Answer 13 · 2018-05-29T21:28:25.000Z

@RyanRamchandar I tried removing the above package but docker-compose got removed too...

Answer 14 · 2018-05-29T21:37:28.000Z

@extraymond Just tried it. Running apt-get remove golang-docker-credential-helpers also removes docker-compose for some reason. Hmm...

Answer 15 · 2018-05-29T22:08:22.000Z

@RyanRamchandar it removes docker-compose as well which I cannot afford to lose on my headless Ubuntu 18.04. Any other ideas anyone?

So for now i switched my scripts to do what compose would have done for me, but like this there is no point to continue using aws ecr for me now since I won't be able to docker login on any host that has docker-compose installed, which in turn defeats the whole purpose..

I could of course just totally packer everything into AMIs and spool these up but cmon.. this annoys me seriously

Answer 16 · 2018-05-29T22:14:22.000Z

@Megachill I'd like to preserve docker-compose too. Still investigating.

Answer 17 · 2018-05-30T20:07:01.000Z

If you'd like to keep docker-compose on Ubuntu while removing the golang-docker-credential-helpers package, you can apt remove, and then just install the docker-compose binary manually: https://docs.docker.com/compose/install/#install-compose

Answer 18 · 2018-10-04T14:35:03.000Z

The real problem is that golang-docker-credential-helpers should not be a requirement for the ubuntu/debian docker-compose package. Closing this bug does nothing to address that fundamental issue.

Answer 19 · 2018-10-04T14:36:07.000Z

The correct workaround should be

do not automatically install golang-docker-credential-helpers when installing docker-compose
allow the user to apt remove golang-docker-credential-helpers without removing docker-compose

This is actually a packaging issue. I will open the appropriate debian and ubuntu bugs time permitting.

Answer 20 · 2018-10-04T15:39:55.000Z

https://bugs.launchpad.net/ubuntu/+source/docker-compose/+bug/1796119

Answer 21 · 2018-10-15T15:15:55.000Z

Ubuntu 18.0.1 when installing docker-compose (apt install docker-compose) it comes with golang-docker-credential-helpers
quick solution is to apt remove golang-docker-credential-helpers => docker login => then apt install docker-compose back

Answer 22 · 2018-10-15T15:30:26.000Z

@abdrmdn Tried that but didn't work. See #60 (comment)

Answer 23 · 2018-10-22T09:27:20.000Z

You can do rm /usr/bin/docker-credential-secretservice after you installed docker-compose since removing golang-docker-credential-helpers will remove the entire docker-compose

Answer 24 · 2018-10-24T19:56:44.000Z

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=910822
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=910823

Answer 25 · 2018-11-16T07:14:40.000Z

@extraymond Just tried it. Running apt-get remove golang-docker-credential-helpers also removes docker-compose for some reason. Hmm...

It worked Thanks

Answer 26 · 2018-12-12T23:31:59.000Z

You can do rm /usr/bin/docker-credential-secretservice after you installed docker-compose since removing golang-docker-credential-helpers will remove the entire docker-compose

It only removes the old docker-compose. The by docker supported one remains.

Answer 27 · 2019-01-02T13:48:12.000Z

You can also remove golang-docker-credentials-helpers using dpkg:
sudo dpkg --remove --force-depends golang-docker-credential-helpers

Answer 28 · 2019-08-26T20:51:29.000Z

I had kind of similar issue, just remove
"credsStore": "secretservice" line from the docker config file, if you do not need it. Then the login should go smoothly. I found the answer here: #24

Be aware that if you do this your docker login password may be stored in the clear in your config.json file.

Answer 29 · 2019-09-26T05:26:35.000Z

Ubuntu 18.0.1 when installing docker-compose (apt install docker-compose) it comes with golang-docker-credential-helpers
quick solution is to apt remove golang-docker-credential-helpers => docker login => then apt install docker-compose back

thanks for your answer

Answer 30 · 2019-10-04T19:55:02.000Z

You can remove the package and ignore the dependency. I did the following and it fixed the problem:

dpkg -r --ignore-depends=golang-docker-credential-helpers golang-docker-credential-helpers
(Reading database ... 92450 files and directories currently installed.)
Removing golang-docker-credential-helpers (0.5.0-2) ...

Answer 31 · 2019-10-26T14:57:16.000Z

@nicholasbernstein if I do so I get

dockerpycreds.errors.InitializationError: docker-credential-secretservice not installed or not available in PATH

Answer 32 · 2020-01-07T15:17:58.000Z

@nicholasbernstein if I do so I get

dockerpycreds.errors.InitializationError: docker-credential-secretservice not installed or not available in PATH

Also getting this.

Edit: Instead of removing golang-docker-credential-helpers I did rm /usr/bin/docker-credential-secretservice and then a docker login, this forces the auth to be stored in ~/.docker/config.json instead of the secretservice

Answer 33 · 2020-01-07T15:48:37.000Z

rm /usr/bin/docker-credential-secretservice

This is not a great solution cause apt will think this package is still install and this could lead to strange errros.

Use this sudo dpkg --remove --force-depends golang-docker-credential-helpers

Answer 34 · 2020-05-23T10:26:37.000Z

Try this: https://hackernoon.com/getting-rid-of-docker-plain-text-credentials-88309e07640d
https://github.com/docker/docker-credential-helpers/releases

Answer 35 · 2021-03-16T17:07:39.000Z

Why this is closed?

The error is not solved...

Answer 36 · 2022-03-10T12:43:57.000Z

Not resolved! Come on !

Answer 37 · 2022-06-27T17:13:21.000Z

just started getting this out of the blue in ubuntu 22.04

Answer 38 · 2022-07-25T10:10:58.000Z

just started getting this out of the blue in ubuntu 22.04

Same with me on Ubuntu 22.04 LTS

The most voted answer in this Stackoverflow help me solve the issue
https://stackoverflow.com/questions/50151833/cannot-login-to-docker-account

Answer 39 · 2022-10-18T07:37:25.000Z

For anyone using docker-desktop on ubuntu 20.04 and facing this issue.

Make sure you have pass and gpg installed. Then Follow this page: https://docs.docker.com/desktop/get-started/ to initialize pass.
Install the docker credential helper. sudo apt install golang-docker-credential-helpers
Initialize helper pass: pass insert docker-credential-helpers/docker-pass-initialized-check and set your password.
edit the ~/.docker/.config.json (create one if needed) and insert

{
 "credsStore": "pass"
}

docker logout
docker login

Answer 40 · 2022-11-11T07:55:06.000Z

it seems like when you pull image from public hub, it docker automatically make you need to login, just do as #60 (comment) in ~/.docker/config.json or C:\Users\<UserNameHere>\.docker\config.json. It's work for me tho. My case is win10 pro + wsl. Both run docker compose up fine after do as above

Answer 41 · 2022-12-05T22:39:10.000Z

after I update to Mac OS 10.13.1 (17B48) this problem appears and It solved by removing "credsStore": from ~/.docker/config.json

This works for me.

I followed these steps:

cd ~/.docker/
run sudo nano config.json
you will see an object like: { "credsStore" : desktop } just remove the content of the object and have an empty object { }
type control + o to save what you have just edited in the config.json file.
press control + x key to exit from the terminal
go back to rerun your docker command and it should work

Answer 42 · 2022-12-13T09:02:51.000Z

Only with run the first two points here, worked for me on Debian 11:

* Make sure you have `pass` and `gpg` installed. Then Follow this page: https://docs.docker.com/desktop/get-started/ to initialize `pass`.

* Install the docker credential helper. `sudo apt install golang-docker-credential-helpers`

Answer 43 · 2023-04-14T00:50:45.000Z

Still a bug

Answer 44 · 2023-06-13T08:37:46.000Z

same question, fixed by:

open ~/.docker/config.json
remove "credsStore": "desktop"

Answer 45 · 2023-07-05T21:26:21.000Z

For those on MacOS, I've noticed that docker will add "credsStore": "desktop" back to the config whenever it starts up and will crash if you change the config permissions to read-only. I was able to fix this by updating ~/.docker/config.json to have "credsStore": "osxkeychain".

Now, whenever I restart docker I no longer need to edit the config file.

Answer 46 · 2023-07-12T20:13:45.000Z

@MuktadirHassan funcionou pra mim , muito obrigado !! <3 🇧🇷 🇧🇷 🇧🇷

Answer 47 · 2023-09-29T02:39:24.000Z

For those on Archlinux, docker add "credsStore": "desktop" on ~/.docker/config.json file. Updating this to removing this key works for me.

Answer 48 · 2023-11-16T09:42:38.000Z

I ran into this issue using Ubuntu WSL and Rancher Desktop. I had previously (a couple weeks ago) logged into my registry, but my solution was to simply log in again using:
docker login <your.registry.url>

Answer 49 · 2024-01-23T14:51:47.000Z

In my case I use WSL2 Debian and I had this issue, and I solved it by using

rm ~/.docker/config.json

Answer 50 · 2024-05-26T21:34:20.000Z

after I update to Mac OS 10.13.1 (17B48) this problem appears and It solved by removing "credsStore": from ~/.docker/config.json

this fixed it for me. Thanks!

Answer 51 · 2024-07-29T22:37:49.000Z

I had kind of similar issue, just remove "credsStore": "secretservice" line from the docker config file, if you do not need it. Then the login should go smoothly. I found the answer here: #24

I can't believe this worked... literally been fighting this for 3 hours. You're a life saver!

I'm assuming this works because of the internal fallback logic of docker credentials helper? (e.g. looks for pass first, then secretservice, then...)

I was getting errors about how the context was canceled due to no gpg secret key. When I would do a docker logout I would get an error about how credentials couldn't be removed from storage because they couldn't be found. It wasn't until I removed this line from the configuration file, that I was able to logout with no errors, then login, and image pull was working again.

I had to update my GPG Key, and in the process, I think it was somehow persistent in the credentials cache as missing credentials, and only knew about it on logout. I had already updated the new GPG key everywhere else, but for some reason docker was holding on to the old reference.