GoogleContainerTools/jib · error · CredentialHelperUnhandledServerUrlException

The credential helper ${credentialHelper} returned no creden

Error message

The credential helper ${credentialHelper} returned no credentials for server URL ${serverUrl}; error output: ${errorOutput}

What it means

Another CredentialHelperUnhandledServerUrlException path: the credential helper process exited successfully but wrote nothing to stdout and non-empty error output to stderr. Jib treats that as 'no credentials for this server URL' and includes the helper's stderr in the message.

Source

Thrown at jib-core/src/main/java/com/google/cloud/tools/jib/registry/credentials/DockerCredentialHelper.java:177

      try (OutputStream processStdin = process.getOutputStream()) {
        processStdin.write(serverUrl.getBytes(StandardCharsets.UTF_8));
      }

      try (InputStreamReader processStdoutReader =
          new InputStreamReader(process.getInputStream(), StandardCharsets.UTF_8)) {
        String output = CharStreams.toString(processStdoutReader);

        // Throws an exception if the credential store does not have credentials for serverUrl.
        if (output.contains("credentials not found in native keychain")) {
          throw new CredentialHelperUnhandledServerUrlException(
              credentialHelper, serverUrl, output);
        }
        if (output.isEmpty()) {
          try (InputStreamReader processStderrReader =
              new InputStreamReader(process.getErrorStream(), StandardCharsets.UTF_8)) {
            String errorOutput = CharStreams.toString(processStderrReader);
            throw new CredentialHelperUnhandledServerUrlException(
                credentialHelper, serverUrl, errorOutput);
          }
        }

        try {
          DockerCredentialsTemplate dockerCredentials =
              JsonTemplateMapper.readJson(output, DockerCredentialsTemplate.class);
          if (Strings.isNullOrEmpty(dockerCredentials.username)
              || Strings.isNullOrEmpty(dockerCredentials.secret)) {
            throw new CredentialHelperUnhandledServerUrlException(
                credentialHelper, serverUrl, output);
          }

          return Credential.from(dockerCredentials.username, dockerCredentials.secret);

        } catch (JsonProcessingException ex) {
          throw new CredentialHelperUnhandledServerUrlException(
              credentialHelper, serverUrl, output);

View on GitHub (pinned to fb949e2676)

Solutions

Run the helper manually ('echo <serverUrl> | docker-credential-<helper> get') to see its stderr and fix the underlying cause.
Re-run 'docker login <serverUrl>' to store valid credentials.
Update or reinstall the credential helper binary.
Supply credentials explicitly in the build configuration instead of via the helper.

Example fix

// debug before fixing
echo gcr.io | docker-credential-gcr get
// after (fixed helper/config), or:
jib { to { auth { username = 'user'; password = 'pass' } } }

Defensive patterns

Strategy: try-catch

Validate before calling

// Probe helper stdout/stderr before use
Process p = new ProcessBuilder("docker-credential-<helper>", "get").start();
p.getOutputStream().write((serverUrl + "\n").getBytes()); p.getOutputStream().close();
boolean ok = p.getInputStream().readAllBytes().length > 0;

Try / catch

try { retrieve(); } catch (CredentialHelperUnhandledServerUrlException e) { logger.warn("Helper produced no stdout: {}", e.getMessage()); }

Prevention

Update credential helper binaries regularly.
Fix keychain/keyring access permissions (macOS/Windows).
Test helpers manually with echo <server> | docker-credential-<x> get.
Avoid wrapper scripts that swallow stdout.

When it happens

Trigger: Helper binary prints diagnostics to stderr and exits 0 without JSON on stdout; helper fails softly (e.g. keychain locked) producing no stdout; serverUrl unknown to the helper so it emits nothing on stdout.

Common situations: macOS keychain access denied to docker-credential-osxkeychain; helper misconfigured for the registry; older helper versions that don't recognize the server URL.

Related errors

AI-assisted analysis of GoogleContainerTools/jib@fb949e2676 (2026-09-06). Data as JSON: /api/errors/5fff9a836db903ea. Report an issue: GitHub.