{"record":{"id":"1f3bdbc725a3d96b","repo":"docker/cli","slug":"resolving-credentials-failed-w","errorCode":null,"errorMessage":"resolving credentials failed: %w","messagePattern":"resolving credentials failed: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cli/command/container/auth_config_utils.go","lineNumber":43,"sourceCode":"func readCredentials(dockerCLI config.Provider) (creds map[string]types.AuthConfig, _ error) {\n\tif v, ok := os.LookupEnv(\"DOCKER_AUTH_CONFIG\"); ok && v != \"\" {\n\t\t// The results are expected to have been unmarshaled the same as\n\t\t// when reading from a config-file, which includes decoding the\n\t\t// base64-encoded \"username:password\" into the \"UserName\" and\n\t\t// \"Password\" fields.\n\t\tac := &configfile.ConfigFile{}\n\t\tif err := ac.LoadFromReader(strings.NewReader(v)); err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to read credentials from DOCKER_AUTH_CONFIG: %w\", err)\n\t\t}\n\t\tif len(ac.AuthConfigs) > 0 {\n\t\t\treturn ac.AuthConfigs, nil\n\t\t}\n\t}\n\n\t// Resolve this here for later, ensuring we error our before we create the container.\n\tcreds, err := dockerCLI.ConfigFile().GetAllCredentials()\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"resolving credentials failed: %w\", err)\n\t}\n\treturn creds, nil\n}\n","sourceCodeStart":25,"sourceCodeEnd":47,"githubUrl":"https://github.com/docker/cli/blob/4f84911bfe8811e9b028e4b1fee8e7510be79387/cli/command/container/auth_config_utils.go#L25-L47","documentation":"Returned by readCredentials() when DOCKER_AUTH_CONFIG is absent/empty and the fallback call to dockerCLI.ConfigFile().GetAllCredentials() fails (cli/command/container/auth_config_utils.go:41-44). GetAllCredentials walks all configured auth entries and may consult the OS credential helper (pass, wincred, osxkeychain, secretservice); a helper invocation failure or a corrupt config.json auth section surfaces here.","triggerScenarios":"Using --use-api-socket on docker create/run without DOCKER_AUTH_CONFIG, where the local credential store cannot be read: the configured credsStore helper binary is missing/non-functional, returns an error, or an auths entry is malformed.","commonSituations":"credsStore set to 'pass'/'osxkeychain'/'secretservice' but the helper is not installed or not initialized; config.json references a helper that errors; GPG/pass backend locked or misconfigured; corrupted ~/.docker/config.json.","solutions":["Verify the configured credential helper is installed and functional: docker-credential-<name> list should succeed.","For 'pass', ensure the GPG key and password store are initialized (gpg --list-keys, pass init <keyid>).","Inspect ~/.docker/config.json for a credsStore value pointing at a missing helper, and install or unset it.","If you intend to supply creds directly, set DOCKER_AUTH_CONFIG to bypass the local store."],"exampleFix":"# before\n# config.json has \"credsStore\":\"pass\" but pass/GPG not initialized -> GetAllCredentials fails\n# after\npass init <gpg-key-id>\n# or remove the helper:\n# edit ~/.docker/config.json -> remove credsStore, restart shell","handlingStrategy":"try-catch","validationCode":"// Verify the configured credential helper responds before relying on it.\nfunc validateCredsHelper(store string) error {\n    cmd := exec.Command(\"docker-credential-\"+store, \"list\")\n    if err := cmd.Run(); err != nil {\n        return fmt.Errorf(\"credential helper %q not functional: %w\", store, err)\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":"creds, err := dockerCLI.ConfigFile().GetAllCredentials()\nif err != nil {\n    // hint: check credsStore in ~/.docker/config.json, install/initialize the helper\n}","preventionTips":["Install and initialize the credential helper named in config.json's credsStore.","For 'pass', run pass init <gpg-keyid> and confirm docker-credential-pass list works.","Set DOCKER_AUTH_CONFIG to bypass a broken local store when needed."],"tags":["authentication","credentials","credential-helper","configuration"],"backgroundTag":null,"analyzedSha":"4f84911bfe8811e9b028e4b1fee8e7510be79387","analyzedAt":"2026-08-07T12:15:29.814Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}