{"record":{"id":"3d33f1bacbf0952e","repo":"hashicorp/nomad","slug":"s-with-input-q-failed-with-stderr-s","errorCode":null,"errorMessage":"%s with input %q failed with stderr: %s","messagePattern":"(.+?) with input %q failed with stderr: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"drivers/docker/utils.go","lineNumber":207,"sourceCode":"func authFromHelper(helperName string) authBackend {\n\treturn func(repo string) (*registrytypes.AuthConfig, error) {\n\t\tif helperName == \"\" {\n\t\t\treturn nil, nil\n\t\t}\n\t\thelper := dockerAuthHelperPrefix + helperName\n\t\tcmd := exec.Command(helper, \"get\")\n\n\t\trepoInfo, err := parseRepositoryInfo(repo)\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\n\t\tcmd.Stdin = strings.NewReader(repoInfo.Index.Name)\n\t\toutput, err := cmd.Output()\n\t\tif err != nil {\n\t\t\texitErr, ok := err.(*exec.ExitError)\n\t\t\tif ok {\n\t\t\t\treturn nil, fmt.Errorf(\n\t\t\t\t\t\"%s with input %q failed with stderr: %s\", helper, repo, exitErr.Stderr)\n\t\t\t}\n\t\t\treturn nil, err\n\t\t}\n\n\t\tvar response map[string]string\n\t\tif err := json.Unmarshal(output, &response); err != nil {\n\t\t\treturn nil, err\n\t\t}\n\n\t\tauth := &registrytypes.AuthConfig{\n\t\t\tUsername: response[\"Username\"],\n\t\t\tPassword: response[\"Secret\"],\n\t\t}\n\t\tif err := encodeAuth(auth); err != nil {\n\t\t\treturn nil, err\n\t\t}\n","sourceCodeStart":189,"sourceCodeEnd":225,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/drivers/docker/utils.go#L189-L225","documentation":"When the docker credential-helper subprocess (helper like docker-credential-ecr-login) exits non-zero, this error wraps the helper name, the repo string passed on stdin, and the helper's stderr. It means the external credential helper binary itself failed, not the docker daemon.","triggerScenarios":"Running cmd.Output() on a configured credential helper that exits non-zero (exec.ExitError): missing AWS/ECR credentials, expired tokens, helper binary crashing, or a helper not installed for the registry domain.","commonSituations":"Nomad client with credsStore/credHelpers configured pulling from ECR/GCR without valid cloud credentials (missing AWS_ACCESS_KEY_ID or IAM permissions), stale ~/.docker/config.json pointing at a removed helper, helper not on PATH causing unexpected behavior.","solutions":["Read the stderr in the error message; fix the underlying helper problem (re-auth with `aws ecr get-login` / `gcloud auth login`, refresh credentials).","Verify the helper binary exists and is executable: run `<helper> get` manually piping the registry URL.","Check ~/.docker/config.json credsStore/credHelpers entries match installed helpers.","Ensure the Nomad client user's environment (PATH, HOME, cloud env vars) exposes the helper and credentials."],"exampleFix":"// before (helper exits 1)\n// aws ecr get-authorization-token fails: no credentials\n// after: give the Nomad client a working credential chain\nexport AWS_ACCESS_KEY_ID=... AWS_SECRET_ACCESS_KEY=... AWS_REGION=us-east-1\n# or attach an instance profile with ecr:GetAuthorizationToken","handlingStrategy":"try-catch","validationCode":"// preflight: ensure the helper is present and credentials work\nif _, err := exec.LookPath(helper); err != nil {\n  return fmt.Errorf(\"credential helper %s not installed\", helper)\n}\nif code, _ := exec.Command(helper, \"get\").ProcessState // or run once with registry input and check exit code; non-zero => fix creds first","typeGuard":"func isHelperFailure(err error) (*exec.ExitError, bool) {\n  var ee *exec.ExitError\n  return ee, errors.As(err, &ee)\n}","tryCatchPattern":"resp, err := fetchCreds(repo)\nif err != nil {\n  var ee *exec.ExitError\n  if errors.As(err, &ee) {\n    log.Printf(\"helper failed: %s\", ee.Stderr)\n    return nil, fmt.Errorf(\"credential helper unavailable: %w\", err) // do not retry blindly\n  }\n  return nil, err\n}","preventionTips":["Keep cloud credentials (AWS/GCR) fresh on Nomad clients via instance profiles/workload identity.","Pin helper binaries on PATH for the nomad user, not just root.","Reconcile ~/.docker/config.json credsStore/credHelpers with installed helpers during provisioning."],"tags":["docker","credential-helper","subprocess","registry-auth"],"backgroundTag":"credential-helper-failed","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}