GoogleContainerTools/jib · warning

InferredAuthException: ${message}

Error message

InferredAuthException: ${message}

What it means

This is not a thrown exception but a logged warning: while configuring credential retrievers, Jib attempted to use inferred authentication (e.g. from a plugin/provider like the Docker config or extension-supplied auth) and the InferredAuthException raised during that lookup was caught, logged at WARN level, and the build continues without the inferred credential.

Source

Thrown at jib-plugins-common/src/main/java/com/google/cloud/tools/jib/plugins/common/PluginConfigurationProcessor.java:1015

            passwordPropertyName,
            rawAuthConfiguration,
            rawConfiguration);
    if (optionalCredential.isPresent()) {
      defaultCredentialRetrievers.setKnownCredential(
          optionalCredential.get(), rawAuthConfiguration.getAuthDescriptor());
    } else {
      try {
        Optional<AuthProperty> optionalInferredAuth =
            inferredAuthProvider.inferAuth(imageReference.getRegistry());
        if (optionalInferredAuth.isPresent()) {
          AuthProperty auth = optionalInferredAuth.get();
          String username = Verify.verifyNotNull(auth.getUsername());
          String password = Verify.verifyNotNull(auth.getPassword());
          Credential credential = Credential.from(username, password);
          defaultCredentialRetrievers.setInferredCredential(credential, auth.getAuthDescriptor());
        }
      } catch (InferredAuthException ex) {
        projectProperties.log(LogEvent.warn("InferredAuthException: " + ex.getMessage()));
      }
    }

    defaultCredentialRetrievers.setCredentialHelper(
        credHelperConfiguration.getHelperName().orElse(null));
    defaultCredentialRetrievers.asList().forEach(registryImage::addCredentialRetriever);
  }

  private static ImageReference getGeneratedTargetDockerTag(
      RawConfiguration rawConfiguration,
      ProjectProperties projectProperties,
      HelpfulSuggestions helpfulSuggestions)
      throws InvalidImageReferenceException {
    return ConfigurationPropertyValidator.getGeneratedTargetDockerTag(
        rawConfiguration.getToImage().orElse(null), projectProperties, helpfulSuggestions);
  }

  /**

View on GitHub (pinned to fb949e2676)

Solutions

1. Read the wrapped message in the warning and fix the underlying auth source (e.g. re-run docker login or cloud provider login)
2. Verify username/password are present in the auth entry being inferred
3. Configure an explicit credential helper or username/password in the Jib configuration instead of relying on inferred auth
4. Ignore if another credential retriever (helper, explicit creds) succeeds

Example fix

// before
<gcp.projectId>...</gcp.projectId>  // relying on stale inferred gcloud auth
// after
<configuration>
  <from><image>...</image></from>
  <to><image>...</image></to>
</configuration>
# and refresh credentials:
gcloud auth login && gcloud auth configure-docker

// Check that inferred auth entries contain both username and password
Object auth = dockerConfigJson.getAuth();
if (auth == null || auth.getUsername() == null || auth.getPassword() == null) {
  logger.warn("Inferred auth incomplete; configure a credential helper explicitly");
}

try {
  configureInferredAuth();
} catch (InferredAuthException e) {
  logger.warn("Skipping inferred auth: " + e.getMessage());
}

When it happens

Trigger: PluginConfigurationProcessor.configureCredentialRetrievers calls code that may throw InferredAuthException while extracting username/password from inferred auth (e.g. helpers like 'gcloud' credential extension data); on exception it logs "InferredAuthException: <message>" and proceeds with the remaining credential retrievers.

Common situations: Stale or incomplete docker/config.json auth entries (e.g. auths with missing username/password); expired cloud-provider credentials; malformed auth blocks produced by `docker login` variants.

Related errors

• Caused by: ${causeMessage}
• Path does not start with forward slash (/): ${unixPath}
• Cannot create AbsoluteUnixPath from non-absolute Path: ${pat
• Cannot resolve against absolute Path: ${relativePath}
• platforms set cannot be empty

AI-assisted analysis of GoogleContainerTools/jib@fb949e2676 (2026-09-06). Data as JSON: /api/errors/6e01d42bbf4951ea. Report an issue: GitHub.