{"record":{"id":"3b365269cba4f830","repo":"GoogleContainerTools/jib","slug":"the-credential-helper-credentialhelper-returned","errorCode":null,"errorMessage":"The credential helper ${credentialHelper} returned no credentials for server URL ${serverUrl}; output: ${output}","messagePattern":"The credential helper (.+?) returned no credentials for server URL (.+?); output: (.+?)","errorType":"exception","errorClass":"CredentialHelperUnhandledServerUrlException","httpStatus":null,"severity":"error","filePath":"jib-core/src/main/java/com/google/cloud/tools/jib/registry/credentials/DockerCredentialHelper.java","lineNumber":170,"sourceCode":"  private Credential retrieve(List<String> credentialHelperCommand)\n      throws IOException, CredentialHelperUnhandledServerUrlException,\n          CredentialHelperNotFoundException {\n    try {\n      ProcessBuilder processBuilder = processBuilderFactory.apply(credentialHelperCommand);\n      processBuilder.environment().putAll(environment);\n      Process process = processBuilder.start();\n\n      try (OutputStream processStdin = process.getOutputStream()) {\n        processStdin.write(serverUrl.getBytes(StandardCharsets.UTF_8));\n      }\n\n      try (InputStreamReader processStdoutReader =\n          new InputStreamReader(process.getInputStream(), StandardCharsets.UTF_8)) {\n        String output = CharStreams.toString(processStdoutReader);\n\n        // Throws an exception if the credential store does not have credentials for serverUrl.\n        if (output.contains(\"credentials not found in native keychain\")) {\n          throw new CredentialHelperUnhandledServerUrlException(\n              credentialHelper, serverUrl, output);\n        }\n        if (output.isEmpty()) {\n          try (InputStreamReader processStderrReader =\n              new InputStreamReader(process.getErrorStream(), StandardCharsets.UTF_8)) {\n            String errorOutput = CharStreams.toString(processStderrReader);\n            throw new CredentialHelperUnhandledServerUrlException(\n                credentialHelper, serverUrl, errorOutput);\n          }\n        }\n\n        try {\n          DockerCredentialsTemplate dockerCredentials =\n              JsonTemplateMapper.readJson(output, DockerCredentialsTemplate.class);\n          if (Strings.isNullOrEmpty(dockerCredentials.username)\n              || Strings.isNullOrEmpty(dockerCredentials.secret)) {\n            throw new CredentialHelperUnhandledServerUrlException(\n                credentialHelper, serverUrl, output);","sourceCodeStart":152,"sourceCodeEnd":188,"githubUrl":"https://github.com/GoogleContainerTools/jib/blob/fb949e2676afbbd7dd7a1ef61e20251931325654/jib-core/src/main/java/com/google/cloud/tools/jib/registry/credentials/DockerCredentialHelper.java#L152-L188","documentation":"CredentialHelperUnhandledServerUrlException is thrown when a Docker credential helper (e.g. docker-credential-gcr) reports 'credentials not found in native keychain' for the given server URL, meaning the helper ran but has no stored credentials for that registry. Jib translates that helper output into this error.","triggerScenarios":"Running `retrieve` on DockerCredentialHelper for a serverUrl the helper has no entry for; helper stdout contains 'credentials not found in native keychain'.","commonSituations":"docker login was never performed for that registry on this machine; helper configured for one registry (e.g. gcr.io) but image targets another (e.g. asia.gcr.io); credentials removed from keychain.","solutions":["Run 'docker login <serverUrl>' so the helper/credential store has an entry for that exact server URL.","Ensure the correct credential helper for that registry is configured (e.g. credHelpers in ~/.docker/config.json for gcr.io).","Pass credentials directly in the build config (auth.username/auth.password or credSupplier) instead of relying on the helper.","Verify the server URL string matches what the helper keys credentials under (host:port, scheme stripped)."],"exampleFix":"// before: helper has no entry\ngcloud auth configure-docker // adds gcr.io helper config\n// after\ndocker login gcr.io   # or gcloud auth login + configure-docker","handlingStrategy":"try-catch","validationCode":"// Check helper has credentials before build\nProcess p = new ProcessBuilder(\"docker-credential-gcr\", \"list\").start();\nString out = new String(p.getInputStream().readAllBytes());\nboolean ok = out.contains(serverUrl);","typeGuard":null,"tryCatchPattern":"try { cred = DockerCredentialHelper.retrieve(serverUrl, helper); } catch (CredentialHelperUnhandledServerUrlException e) { logger.warn(\"No creds for {} via {}; run 'docker login {}'\", serverUrl, helper, serverUrl); }","preventionTips":["Run 'docker login <serverUrl>' for every registry used.","Ensure the registry URL string matches the helper's key exactly.","Configure credHelpers per registry in ~/.docker/config.json.","Fall back to explicit auth config in CI."],"tags":["docker","credentials","credential-helper"],"backgroundTag":"missing-credentials","analyzedSha":"fb949e2676afbbd7dd7a1ef61e20251931325654","analyzedAt":"2026-09-06T14:04:09.491Z","contentChangedAt":"2026-09-06T14:04:09.491Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}