docker/cli · error

something went wrong decoding auth config

Error message

something went wrong decoding auth config

What it means

Returned by decodeAuth as a defensive guard: after base64-decoding the auth string, if the number of decoded bytes exceeds the precomputed DecodedLen, something is inconsistent. In practice Go's base64 decoder cannot return more bytes than the computed length, so this branch is effectively unreachable for well-formed input and indicates memory/length bookkeeping corruption.

Solutions

1. Log out and back in ('docker logout <registry>' then 'docker login') to regenerate the auth entry cleanly.
2. Inspect ~/.docker/config.json and replace any malformed base64 'auth' values for the affected registry.
3. If using a credential helper, verify it returns a standard base64 of 'username:password'.

user, pass, err := decodeAuth(authStr)
if err != nil {
    // Treat as corrupt credential entry; prompt re-login rather than crashing.
    log.Printf("auth decode failed for entry, will attempt re-login: %v", err)
    return relogin()
}

When it happens

Trigger: Calling decodeAuth with a base64 string. The branch is a sanity assertion; it is not expected to fire under normal control flow. It could only appear alongside a base64 implementation bug or tampered buffers.

Common situations: Almost never seen in the wild. If reported, it usually points to a corrupted ~/.docker/config.json where the 'auth' field was hand-edited or truncated, or a custom credential helper returning malformed data.

Related errors

• invalid auth configuration file
• parsing config file ( )
• DOCKER_AUTH_CONFIG does not support more than one JSON…
• loading config file
• error closing temp file

AI-assisted analysis of docker/cli@4f84911bfe (2026-08-07). Data as JSON: /api/errors/956b0635ea9c4b0f. Report an issue: GitHub.

Appendix: source

Thrown at cli/config/configfile/file.go:310

	base64.StdEncoding.Encode(encoded, msg)
	return string(encoded)
}

// decodeAuth decodes a base64 encoded string and returns username and password
func decodeAuth(authStr string) (string, string, error) {
	if authStr == "" {
		return "", "", nil
	}

	decLen := base64.StdEncoding.DecodedLen(len(authStr))
	decoded := make([]byte, decLen)
	authByte := []byte(authStr)
	n, err := base64.StdEncoding.Decode(decoded, authByte)
	if err != nil {
		return "", "", err
	}
	if n > decLen {
		return "", "", errors.New("something went wrong decoding auth config")
	}
	userName, password, ok := strings.Cut(string(decoded), ":")
	if !ok || userName == "" {
		return "", "", errors.New("invalid auth configuration file")
	}
	return userName, strings.Trim(password, "\x00"), nil
}

// GetCredentialsStore returns a new credentials store from the settings in the
// configuration file
func (c *ConfigFile) GetCredentialsStore(registryHostname string) credentials.Store {
	store := credentials.NewFileStore(c)

	if helper := getConfiguredCredentialStore(c, getAuthConfigKey(registryHostname)); helper != "" {
		store = newNativeStore(c, helper)
	}

	envConfig := os.Getenv(DockerEnvConfigKey)

View on GitHub (pinned to 4f84911bfe)