{"record":{"id":"792824c3d4f178c4","repo":"docker/cli","slug":"resolving-credentials-failed-w-792824","errorCode":null,"errorMessage":"resolving credentials failed: %w","messagePattern":"resolving credentials failed: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cli/command/container/create.go","lineNumber":301,"sourceCode":"\t\t           Mode:      0o600,\n\t\t       },\n\t\t   })\n\t\t*/\n\n\t\tvar envVarPresent bool\n\t\tfor _, envVar := range containerCfg.Config.Env {\n\t\t\tif strings.HasPrefix(envVar, \"DOCKER_CONFIG=\") {\n\t\t\t\tenvVarPresent = true\n\t\t\t}\n\t\t}\n\n\t\t// If the DOCKER_CONFIG env var is already present, we assume the client knows\n\t\t// what they're doing and don't inject the creds.\n\t\tif !envVarPresent {\n\t\t\t// Resolve this here for later, ensuring we error our before we create the container.\n\t\t\tcreds, err := readCredentials(dockerCLI)\n\t\t\tif err != nil {\n\t\t\t\treturn \"\", fmt.Errorf(\"resolving credentials failed: %w\", err)\n\t\t\t}\n\t\t\tif len(creds) > 0 {\n\t\t\t\t// Set our special little location for the config file.\n\t\t\t\tcontainerCfg.Config.Env = append(containerCfg.Config.Env, \"DOCKER_CONFIG=\"+path.Dir(dockerConfigPathInContainer))\n\n\t\t\t\tapiSocketCreds = creds // inject these after container creation.\n\t\t\t}\n\t\t}\n\t}\n\n\tvar platform *ocispec.Platform\n\tif options.platform != \"\" {\n\t\tp, err := platforms.Parse(options.platform)\n\t\tif err != nil {\n\t\t\treturn \"\", invalidParameter(fmt.Errorf(\"error parsing specified platform: %w\", err))\n\t\t}\n\t\tplatform = &p\n\t}","sourceCodeStart":283,"sourceCodeEnd":319,"githubUrl":"https://github.com/docker/cli/blob/4f84911bfe8811e9b028e4b1fee8e7510be79387/cli/command/container/create.go#L283-L319","documentation":"Returned by createContainer() when --use-api-socket is active, DOCKER_CONFIG is not already injected, and readCredentials(dockerCLI) fails (cli/command/container/create.go:299-302). readCredentials itself returns either the DOCKER_AUTH_CONFIG parse error (271) or the GetAllCredentials store error (272); this wrapper re-wraps either as 'resolving credentials failed' so that credential problems fail fast before the container is created.","triggerScenarios":"Running docker create/run with --use-api-socket, where DOCKER_AUTH_CONFIG is malformed (see 271) or the local credential store/helper cannot be read (see 272). The credential resolution is performed early so the container is not created with a broken API-socket credential setup.","commonSituations":"Using --use-api-socket to give a container access to the Docker API with the caller's credentials, but those credentials cannot be resolved due to a malformed DOCKER_AUTH_CONFIG or a broken credsStore helper.","solutions":["Fix DOCKER_AUTH_CONFIG JSON formatting (see error 271).","Ensure the configured credential helper is installed and functional (see error 272).","If you inject DOCKER_CONFIG yourself into the container env, the credential-resolution step is skipped.","Drop --use-api-socket if you do not need the container to authenticate to the Docker API."],"exampleFix":"# before\ndocker run --use-api-socket ...   # DOCKER_AUTH_CONFIG malformed -> resolve fails\n# after\nexport DOCKER_AUTH_CONFIG='{\"auths\":{\"registry.example.com\":{\"auth\":\"<base64>\"}}}'\ndocker run --use-api-socket ...","handlingStrategy":"try-catch","validationCode":"// Resolve credentials explicitly before using --use-api-socket.\nfunc validateCredsForApiSocket(p config.Provider) error {\n    if _, err := container.ReadCredentials(p); err != nil {\n        return fmt.Errorf(\"fix DOCKER_AUTH_CONFIG or credential helper before --use-api-socket: %w\", err)\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":"if _, err := createContainer(ctx, cli, cfg, opts); err != nil {\n    if strings.Contains(err.Error(), \"resolving credentials failed\") {\n        // hint: validate DOCKER_AUTH_CONFIG JSON / credential helper, or drop --use-api-socket\n    }\n}","preventionTips":["Validate DOCKER_AUTH_CONFIG JSON (error 271) and the credential helper (error 272) before --use-api-socket.","Inject DOCKER_CONFIG into the container env yourself to skip client-side resolution.","Only enable --use-api-socket when the credential chain is known-good."],"tags":["container","authentication","credentials","api-socket","configuration"],"backgroundTag":null,"analyzedSha":"4f84911bfe8811e9b028e4b1fee8e7510be79387","analyzedAt":"2026-08-07T12:15:29.814Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}