{"record":{"id":"ede2215cd357af90","repo":"docker/cli","slug":"failed-to-read-credentials-from-docker-auth-config","errorCode":null,"errorMessage":"failed to read credentials from DOCKER_AUTH_CONFIG: %w","messagePattern":"failed to read credentials from DOCKER_AUTH_CONFIG: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cli/command/container/auth_config_utils.go","lineNumber":33,"sourceCode":"//\n//   - If a valid \"DOCKER_AUTH_CONFIG\" env-var is found, and it contains\n//     credentials, it's value is used.\n//   - If no \"DOCKER_AUTH_CONFIG\" env-var is found, or it does not contain\n//     credentials, it attempts to read from the CLI's credentials store.\n//\n// It returns an error if either the \"DOCKER_AUTH_CONFIG\" is incorrectly\n// formatted, or when failing to read from the credentials store.\n//\n// A nil value is returned if neither option contained any credentials.\nfunc readCredentials(dockerCLI config.Provider) (creds map[string]types.AuthConfig, _ error) {\n\tif v, ok := os.LookupEnv(\"DOCKER_AUTH_CONFIG\"); ok && v != \"\" {\n\t\t// The results are expected to have been unmarshaled the same as\n\t\t// when reading from a config-file, which includes decoding the\n\t\t// base64-encoded \"username:password\" into the \"UserName\" and\n\t\t// \"Password\" fields.\n\t\tac := &configfile.ConfigFile{}\n\t\tif err := ac.LoadFromReader(strings.NewReader(v)); err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to read credentials from DOCKER_AUTH_CONFIG: %w\", err)\n\t\t}\n\t\tif len(ac.AuthConfigs) > 0 {\n\t\t\treturn ac.AuthConfigs, nil\n\t\t}\n\t}\n\n\t// Resolve this here for later, ensuring we error our before we create the container.\n\tcreds, err := dockerCLI.ConfigFile().GetAllCredentials()\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"resolving credentials failed: %w\", err)\n\t}\n\treturn creds, nil\n}\n","sourceCodeStart":15,"sourceCodeEnd":47,"githubUrl":"https://github.com/docker/cli/blob/4f84911bfe8811e9b028e4b1fee8e7510be79387/cli/command/container/auth_config_utils.go#L15-L47","documentation":"Returned by readCredentials() when DOCKER_AUTH_CONFIG is set but cannot be parsed into a configfile.ConfigFile (cli/command/container/auth_config_utils.go:31-34). LoadFromReader expects the same JSON format as ~/.docker/config.json (with an 'auths' map); any JSON syntax error or structurally invalid document fails here and is wrapped with this message.","triggerScenarios":"Setting DOCKER_AUTH_CONFIG to a malformed JSON document (missing braces, trailing comma, wrong structure) while using --use-api-socket on docker create/run. The env var is consumed only on that code path; a parse failure aborts credential resolution before container creation.","commonSituations":"Hand-crafted DOCKER_AUTH_CONFIG with a typo, a value that is base64 credentials pasted directly instead of wrapped in the {\"auths\":{...}} structure, or copy-paste truncation. Note the whole document must be valid JSON, not just a base64 blob.","solutions":["Format DOCKER_AUTH_CONFIG as a full config.json document: {\"auths\":{\"registry.example.com\":{\"auth\":\"<base64(user:pass)>\"}}}.","Validate the JSON before exporting: echo \"$DOCKER_AUTH_CONFIG\" | jq . (or python -m json.tool).","Generate the base64 token correctly: printf '%s' 'user:pass' | base64.","If you only need the credentials store, unset DOCKER_AUTH_CONFIG to fall through to it."],"exampleFix":"# before\nexport DOCKER_AUTH_CONFIG='user:pass'   # not valid JSON\n# after\nTOKEN=$(printf '%s' 'user:pass' | base64)\nexport DOCKER_AUTH_CONFIG='{\"auths\":{\"registry.example.com\":{\"auth\":\"'$TOKEN'\"}}}'","handlingStrategy":"validation","validationCode":"// Validate DOCKER_AUTH_CONFIG is a well-formed config.json document.\nfunc validateAuthConfigEnv(value string) error {\n    var cfg struct{ Auths map[string]json.RawMessage }\n    if err := json.Unmarshal([]byte(value), &cfg); err != nil {\n        return fmt.Errorf(\"DOCKER_AUTH_CONFIG must be JSON like {\\\"auths\\\":{...}}: %w\", err)\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Construct the env var from a Go struct marshaled to JSON rather than hand-concatenating strings.","Validate with jq or python -m json.tool before exporting.","Generate base64 with printf '%s' 'user:pass' | base64 (no trailing newline surprises)."],"tags":["authentication","credentials","environment-variable","json","configuration"],"backgroundTag":null,"analyzedSha":"4f84911bfe8811e9b028e4b1fee8e7510be79387","analyzedAt":"2026-08-07T12:15:29.814Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}