DOCKER_AUTH_CONFIG does not support more than one JSON…

Error message

DOCKER_AUTH_CONFIG does not support more than one JSON object

What it means

Returned by parseEnvConfig when parsing DOCKER_AUTH_CONFIG: after successfully decoding one JSON object, decoder.More() reports additional trailing data. The env var is intentionally restricted to a single JSON object ({"auths":{...}}); concatenated or multiple top-level objects are rejected to avoid ambiguous credential resolution.

Solutions

Merge all registries into a single JSON object under one 'auths' key: {"auths":{"reg1":{"auth":"..."},"reg2":{"auth":"..."}}}.
Remove trailing whitespace/objects after the first JSON document.
Validate the value with: echo "$DOCKER_AUTH_CONFIG" | jq type (should print 'object').

Example fix

# before
DOCKER_AUTH_CONFIG='{"auths":{"reg1":{"auth":"x"}}}{"auths":{"reg2":{"auth":"y"}}}'
# after
DOCKER_AUTH_CONFIG='{"auths":{"reg1":{"auth":"x"},"reg2":{"auth":"y"}}}'

Defensive patterns

Strategy: validation

Validate before calling

// Ensure DOCKER_AUTH_CONFIG is a single JSON object before use.
func validateAuthEnv(v string) error {
    dec := json.NewDecoder(strings.NewReader(v))
    var o any
    if err := dec.Decode(&o); err != nil { return err }
    if dec.More() { return errors.New("more than one JSON object in DOCKER_AUTH_CONFIG") }
    if _, ok := o.(map[string]any); !ok { return errors.New("DOCKER_AUTH_CONFIG must be a JSON object") }
    return nil
}

Prevention

Merge multiple registries under one 'auths' object.
Pipe the value through 'jq type' in CI to confirm it is 'object'.
Never concatenate two JSON documents in the same env var.

When it happens

Trigger: Setting DOCKER_AUTH_CONFIG to two JSON objects concatenated, e.g. '{...}{...}', or to a JSON array/stream. Attempting to merge multiple registries by pasting two full config documents into one env var.

Common situations: CI pipelines that build DOCKER_AUTH_CONFIG by concatenating per-registry JSON blobs. Copying two registry auth blocks separated by a newline into the same variable. Templating systems emitting repeated top-level objects.

Related errors

AI-assisted analysis of docker/cli@4f84911bfe (2026-08-07). Data as JSON: /api/errors/7437eadfcac52ddc. Report an issue: GitHub.

Appendix: source

Thrown at cli/config/configfile/file.go:361

		memorystore.WithFallbackStore(store),
	)
	if err != nil {
		_, _ = fmt.Fprintln(os.Stderr, "Failed to create credential store from DOCKER_AUTH_CONFIG: ", err)
		return store
	}

	return envStore
}

func parseEnvConfig(v string) (map[string]types.AuthConfig, error) {
	envConfig := &configEnv{}
	decoder := json.NewDecoder(strings.NewReader(v))
	decoder.DisallowUnknownFields()
	if err := decoder.Decode(envConfig); err != nil && !errors.Is(err, io.EOF) {
		return nil, err
	}
	if decoder.More() {
		return nil, errors.New("DOCKER_AUTH_CONFIG does not support more than one JSON object")
	}

	authConfigs := make(map[string]types.AuthConfig)
	for addr, envAuth := range envConfig.AuthConfigs {
		if envAuth.Auth == "" {
			return nil, fmt.Errorf("DOCKER_AUTH_CONFIG environment variable is missing key `auth` for %s", addr)
		}
		username, password, err := decodeAuth(envAuth.Auth)
		if err != nil {
			return nil, err
		}
		authConfigs[addr] = types.AuthConfig{
			Username:      username,
			Password:      password,
			ServerAddress: addr,
		}
	}
	return authConfigs, nil

View on GitHub (pinned to 4f84911bfe)