Unable to use docker / docker-compose when auth fails

[duxbuse]

If my password changes or there is a network issue and google-cloud-sdk/bin/docker-credential-gcr get fails you will be unable to run any commands locally using docker or docker-compose that have nothing to do with gcloud.

This is a massive pain, that my docker commands have been completely hijacked and if there is an issue with gcloud, then nothing works.

I would expect for it to try and do gcloud stuff, but upon failure let me do what I wanted any way.

It does my head in seeing [1249] Failed to execute script docker-compose for a totally gcloud independent task.

[jonjohnsonjr]

I'd say this is mostly an issue with docker. I believe (@dekkagaijin can correct me if I'm wrong) that docker will fetch all credentials for all registries in your config file before initiating a build, just in case the daemon needs them.

It's a pain to workaround :/ you could remove any unnecessary registries from ~/.docker/config.json or even set up different config files that are stripped down to only contain necessary registries (using to set an appropriate DOCKER_CONFIG or something).

Possibly you could fix this in docker, but I'm not familiar enough with how credentials are fetched and plumbed around to give a reasonable pointer.

FWIW I think this used to be a lot worse before docker/cli#840 and the number of times docker would fetch credentials increased quadratically with the number of configured registries. At least now it's linear 🤷‍♂

[xak2000]

docker will fetch all credentials for all registries in your config file before initiating a build, just in case the daemon needs them

It's a design flaw then, I think... Why docker even tries to do any network calls while all I trying to do is build local image, that is not related to corresponding credential helper in any way?

There should be some method for daemon to say "I need credentials for gcr.io" and only then docker should try to use corresponding credentials helper. Doing it beforehand "just in case" is insane, imho. :-) It not only slows down entirely local operation (that is not related to any credential helpers), but also just prevents to do this operation at all if some helper responds with error or there is a network error.

But anyway it's a docker's design flaw, not docker-credential-gcr's, if I understand right.