{"record":{"id":"0b0a38e7f8eea019","repo":"opentofu/opentofu","slug":"discovering-ambient-oci-registry-credentials-w","errorCode":null,"errorMessage":"discovering ambient OCI registry credentials: %w","messagePattern":"discovering ambient OCI registry credentials: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/command/cliconfig/oci_credentials.go","lineNumber":74,"sourceCode":"\t\t}\n\t\tdefaultCredentialsBlock = c.OCIDefaultCredentials[0]\n\t} else {\n\t\tdefaultCredentialsBlock = newDefaultOCIDefaultCredentials()\n\t}\n\n\tdiscoverAmbientCredentials := defaultCredentialsBlock.DiscoverAmbientCredentials\n\tdockerStyleConfigFiles := defaultCredentialsBlock.DockerStyleConfigFiles\n\tif defaultCredentialsBlock.DefaultDockerCredentialHelper != \"\" {\n\t\tcfgs = append(cfgs, ociauthconfig.NewGlobalDockerCredentialHelperCredentialsConfig(\n\t\t\t\"oci_default_credentials block\",\n\t\t\tdefaultCredentialsBlock.DefaultDockerCredentialHelper,\n\t\t))\n\t}\n\n\tif discoverAmbientCredentials {\n\t\tambientCfgs, err := discoverAmbientOCICredentials(ctx, dockerStyleConfigFiles, discoEnv)\n\t\tif err != nil {\n\t\t\treturn ociauthconfig.CredentialsConfigs{}, fmt.Errorf(\"discovering ambient OCI registry credentials: %w\", err)\n\t\t}\n\t\tcfgs = append(cfgs, ambientCfgs...)\n\t}\n\treturn ociauthconfig.NewCredentialsConfigs(cfgs), nil\n}\n\nfunc discoverAmbientOCICredentials(ctx context.Context, dockerStyleConfigFiles []string, discoEnv ociauthconfig.ConfigDiscoveryEnvironment) ([]ociauthconfig.CredentialsConfig, error) {\n\tif dockerStyleConfigFiles != nil {\n\t\t// explicit config file locations\n\t\t// (non-nil but empty represents completely disabling our search for\n\t\t// Docker-style configuration files.)\n\t\tcfgs, err := ociauthconfig.FixedDockerCLIStyleCredentialsConfigs(\n\t\t\tctx,\n\t\t\tdockerStyleConfigFiles,\n\t\t\tdiscoEnv,\n\t\t)\n\t\tif err != nil {\n\t\t\t// If the user explicitly configured search paths then we treat a failure to","sourceCodeStart":56,"sourceCodeEnd":92,"githubUrl":"https://github.com/opentofu/opentofu/blob/3561785c48c1ce615e7c50261bd351f26053efa2/internal/command/cliconfig/oci_credentials.go#L56-L92","documentation":"OpenTofu assembles its OCI credentials configuration in the oci_default_credentials CLI-config block; this error means the 'ambient discovery' step (reading Docker-style config files and credential helpers from standard locations) failed while building that configuration. In practice it is only reachable when discover_ambient_credentials = true is combined with an explicit docker_style_config_files list, because with automatic discovery the CLI deliberately ignores per-file anomalies. The underlying cause is reported by the wrapped error.","triggerScenarios":"An oci_default_credentials block with discover_ambient_credentials = true and a docker_style_config_files list where at least one listed file is unreadable (permissions, path type) or is not valid JSON; discoverAmbientOCICredentials -> FixedDockerCLIStyleCredentialsConfigs returns an error which is wrapped here.","commonSituations":"Typo in a docker_style_config_files path; pointing at a file with restrictive permissions; a partially-written or hand-edited Docker config.json; CI images where $HOME/.docker does not exist at the explicitly-given path.","solutions":["Check the wrapped error: it names the exact file and whether it was a read or parse failure","Verify every path in docker_style_config_files exists, is readable, and contains valid JSON (e.g. jq . <file>)","Fix permissions (chmod 644) or correct the path spelling","If the files were not intentional, remove docker_style_config_files to return to automatic discovery, which tolerates missing/broken files","Set docker_style_config_files = [] if you want ambient Docker-style lookup fully disabled"],"exampleFix":"# before (CLI config)\noci_default_credentials {\n  discover_ambient_credentials = true\n  docker_style_config_files = [\"/home/me/.docker/config.jsom\"]\n}\n# after\nci_default_credentials {}  # typo removed; automatic discovery of default locations","handlingStrategy":"validation","validationCode":"// Before enabling discovery with explicit files, verify each is readable JSON.\nfunc validateDockerStyleFiles(paths []string) error {\n\tfor _, p := range paths {\n\t\tfi, err := os.Stat(p)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"%s: %w\", p, err)\n\t\t}\n\t\tif fi.IsDir() || fi.Mode().Perm()&0o400 == 0 {\n\t\t\treturn fmt.Errorf(\"%s: not readable\", p)\n\t\t}\n\t\tdata, err := os.ReadFile(p)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"%s: %w\", p, err)\n\t\t}\n\t\tif !json.Valid(data) {\n\t\t\treturn fmt.Errorf(\"%s: not valid JSON\", p)\n\t\t}\n\t}\n\treturn nil\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Run a config lint (json checks) on docker_style_config_files in CI before invoking OpenTofu","Prefer omitting docker_style_config_files unless you truly need custom locations; automatic discovery tolerates broken files","Keep Docker config files owned by the same user that runs OpenTofu"],"tags":["oci","credentials","docker","cli-config","config"],"backgroundTag":null,"analyzedSha":"3561785c48c1ce615e7c50261bd351f26053efa2","analyzedAt":"2026-08-15T23:27:16.226Z","schemaVersion":2},"datasetVersion":"2026-08-16T03:17:38.424Z"}