{"record":{"id":"ba8c8e3e986de954","repo":"docker/compose","slug":"saving-creds-for-api-socket-w","errorCode":null,"errorMessage":"saving creds for API socket: %w","messagePattern":"saving creds for API socket: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/compose/apiSocket.go","lineNumber":58,"sourceCode":"\tif !useAPISocket {\n\t\treturn project, nil\n\t}\n\n\tif s.getContextInfo().ServerOSType() == \"windows\" {\n\t\treturn nil, errors.New(\"use_api_socket can't be used with a Windows Docker Engine\")\n\t}\n\n\tcreds, err := s.configFile().GetAllCredentials()\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"resolving credentials failed: %w\", err)\n\t}\n\n\tnewConfig := &configfile.ConfigFile{\n\t\tAuthConfigs: creds,\n\t}\n\tvar configBuf bytes.Buffer\n\tif err := newConfig.SaveToWriter(&configBuf); err != nil {\n\t\treturn nil, fmt.Errorf(\"saving creds for API socket: %w\", err)\n\t}\n\n\tproject.Configs[\"#apisocket\"] = types.ConfigObjConfig{\n\t\tContent: configBuf.String(),\n\t}\n\n\tfor name, service := range project.Services {\n\t\tif !service.UseAPISocket {\n\t\t\tcontinue\n\t\t}\n\t\tservice.Volumes = append(service.Volumes, types.ServiceVolumeConfig{\n\t\t\tType:   types.VolumeTypeBind,\n\t\t\tSource: \"/var/run/docker.sock\",\n\t\t\tTarget: \"/var/run/docker.sock\",\n\t\t})\n\n\t\t_, envvarPresent := service.Environment[\"DOCKER_CONFIG\"]\n","sourceCodeStart":40,"sourceCodeEnd":76,"githubUrl":"https://github.com/docker/compose/blob/ddc4b044b62e9f715212ea4143fa830fac76382f/pkg/compose/apiSocket.go#L40-L76","documentation":"Continuing the use_api_socket flow: after credentials are collected, they are written into an in-memory docker config via newConfig.SaveToWriter so they can be embedded as a project config. This error wraps SaveToWriter failing — almost always because an individual credential (username/password/token) contains data that cannot be serialized into the auth JSON, or because GetAllCredentials returned entries with unusable values.","triggerScenarios":"A credential entry containing invalid UTF-8 or structurally invalid auth data that JSON-encodes/decodes badly; identity tokens or registry-specific helpers producing entries that do not fit the AuthConfigs schema.","commonSituations":"Rare; seen with exotic credential helpers or manually edited ~/.docker/config.json auths entries; occasionally after a Docker Desktop credential migration that leaves half-written entries.","solutions":["Inspect ~/.docker/config.json auths/credHelpers entries for malformed values and remove stale ones","Re-do docker login against the affected registry to rewrite a clean entry","Switch to a standard credential store (desktop/pass/secretservice) temporarily to isolate the failing helper","Disable use_api_socket if the feature is not strictly needed"],"exampleFix":"# before: stale malformed entry\n\"auths\": { \"https://old-registry.example\": { \"auth\": \"not-base64!!\" } }\n# after: remove and re-login\n$ jq 'del(.auths[\"https://old-registry.example\"])' ~/.docker/config.json > tmp && mv tmp ~/.docker/config.json\n$ docker login old-registry.example\n","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"if err := compose.Up(ctx, project, api.UpOptions{}); err != nil {\n\tif strings.Contains(err.Error(), \"saving creds for API socket\") {\n\t\t// a specific credential entry failed to serialize: prune auths entries and docker login again\n\t\treturn errors.Join(err, fixCredsHint())\n\t}\n\treturn err\n}","preventionTips":["Re-login after changing credential stores instead of migrating entries by hand","Keep auths entries as produced by docker login; never hand-edit base64 auth blobs","Periodically prune registry entries you no longer use"],"tags":["credentials","serialization","api-socket","authentication"],"backgroundTag":null,"analyzedSha":"ddc4b044b62e9f715212ea4143fa830fac76382f","analyzedAt":"2026-08-15T13:31:42.319Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}