jdx/mise · warning

{bin} get failed for {server}: {stderr}

Error message

{bin} get failed for {server}: {stderr}

What it means

mise resolves registry credentials by shelling out to the Docker credential helper configured via `credsStore`/`credHelpers` (`docker-credential-<helper> get`). If the helper process exits with a non-zero status, mise raises this error including the helper's stderr. Note the caller treats helper failures as 'no credentials for this registry' and falls through to other sources, but the error is surfaced in debug output.

Source

Thrown at src/oci/auth.rs:261

    let mut command = Command::new(&bin);
    command
        .arg("get")
        .stdin(Stdio::piped())
        .stdout(Stdio::piped())
        .stderr(Stdio::piped());
    prepare_noninteractive_child(&mut command);
    let mut child = command
        .spawn()
        .wrap_err_with(|| format!("spawning {bin} (from credHelpers/credsStore)"))?;
    let _running_pid = RunningPidGuard::new(Some(child.id()));
    {
        use std::io::Write;
        let mut stdin = child.stdin.take().expect("stdin piped");
        stdin.write_all(server.as_bytes())?;
    }
    let out = child.wait_with_output()?;
    if !out.status.success() {
        bail!(
            "{bin} get failed for {server}: {}",
            String::from_utf8_lossy(&out.stderr).trim()
        );
    }
    #[derive(Deserialize)]
    struct HelperResponse {
        #[serde(rename = "Username")]
        username: String,
        #[serde(rename = "Secret")]
        secret: String,
    }
    let resp: HelperResponse = serde_json::from_slice(&out.stdout)
        .wrap_err_with(|| format!("parsing {bin} get output"))?;
    Ok(Credential {
        username: resp.username,
        secret: resp.secret,
    })
}

View on GitHub (pinned to afd2eddd3a)

Solutions

1. Fix the underlying helper: ensure Docker Desktop is running, or the OS keyring/`pass` backend is available and unlocked.
2. Change `credsStore` in the docker config to a helper that works in this environment (e.g. use plain `auths` entries or `docker-credential-pass`).
3. Log in non-interactively with explicit credentials (`docker login -u user -p token`) so `auths` entries are used instead of the helper.
4. Remove/replace the broken `credHelpers` entry for this registry so mise skips it and falls through to other credential sources.

Example fix

// before (~/.docker/config.json)
{ "credsStore": "desktop" }
// after (headless/CI environment)
{ "auths": { "ghcr.io": { "auth": "<base64 user:token>" } } }

if ! command -v "docker-credential-$STORE" >/dev/null 2>&1; then
  echo "helper docker-credential-$STORE missing"; fi
# also verify the backend is reachable, e.g.:
docker-credential-desktop list > /dev/null 2>&1 || echo "credential backend unavailable"

match credential_from_file(...) {
    Ok(cred) => use(cred),
    Err(e) => { debug!("credential helper failed: {e}"); fall_back_to_next_source(); }
}

When it happens

Trigger: Running `docker-credential-<store> get <registry>` where the helper binary fails: the backing store (osxkeychain, secretservice, pass, desktop) is unavailable/locked, the helper can't reach its backend, or the registry server string is rejected by the helper.

Common situations: `credsStore": "desktop"` on a machine where Docker Desktop isn't running; Linux without a secretservice/keyring (no gnome-keyring or D-Bus session); `pass` store missing the entry or GPG key unavailable; CI containers where the keychain daemon isn't running.

Related errors

• {bin} get failed for {server}: {}
• {}: expected exactly one manifest in index.json
• `docker load` failed ({}): {}. Ensure the docker daemon is r
• `auth` for {key} is not `user:password`
• {image_dir.display}: expected exactly one manifest in index.

AI-assisted analysis of jdx/mise@afd2eddd3a (2026-09-09). Data as JSON: /api/errors/f027e2633c6f4ed4. Report an issue: GitHub.