Pulling after logging in to ecr registry appears not to work

Apologies if this is just an oversight on my part, but it stumped me today.

Assuming I have gotten the ecr credentials from boto already in an object called creds, when I do:

client = from_env()
client.login(creds.username, password=creds.password, registry=creds.endpoint)

I get:

{u'IdentityToken': u'', u'Status': u'Login Succeeded'}

Great so far! And I inspect:

client.api.__dict__

I get:

{'_auth_configs': {'auths': {'registry_i_just_logged_into': {'email': None,
'password': 'xxxxxxxxxxxxx',
'serveraddress': 'registry_i_just_logged_into',
'username': 'xxxxxxx'},
u'some_other_registry': {},
'credsStore': u'osxkeychain'}
.... (etc, etc)

Still so far, so good. But when I then do:

client.images.pull("registry_i_just_logged_into/some_repo", tag="latest")

Or when I do (from a command line, and not expecting this to work):

docker pull registry_i_just_logged_into/some_repo:latest

I always get:

Error response from daemon: pull access denied for some_repo, repository does not exist or may require 'docker login'

Despite the fact that, if I do (with the same username and password I used to log in):

client.images.pull("registry_i_just_logged_into/some_repo", tag="latest", auth_config={'username': creds.username, 'password': creds.password})

It works no problems.

I’m dumb. What am I doing wrong?

Thanks!

[Karhide]

So to follow on, is there a way I can make this not happen? I’d like any users of my code to not have to go through the same thing.

[shin-]

What version of the library are you using?

Your credsStore probably overrides the login you provided through the command. Try removing that from your config file and see if that resolves the issue (not saying the current behavior is correct though, just that it’s probably what’s happening)