Unable to pull eclipse-temurin:11-jre from local CLI

Environment:

• Jib version: 3.2.1
• Build tool: Gradle
• OS: Windows 11

Description of the issue:

I am encountering errors when running the jibDockerBuild task locally on a Spring Boot project. Jib fails to pull the public eclipse-temurin image from Docker Hub registry because of authentication issues.

Precisely, it tries to authenticate to Docker Hub to pull a public image, which shouldn’t be required. Even if I log in to Docker Hub (as I do have an account) the error is the same. The error does not occur when running the build on Azure DevOps Pipelines agent (btw, Ubuntu agent).

Please note that my target image is a private Azure Container Registry image, namely avgorbitregistry.azurecr.io/.... I don’t need to push the image, but I can successfully log in to ACR but the error still applies

Expected behavior:

To build the image successfully

Steps to reproduce:

Run .\gradlew -P"gitCommitId=abcdef" -P"reckon.stage=FINAL" jibDockerBuild, employing the Reckon plugin to determine image tag

jib-gradle-plugin Configuration:

This is in a separate file that is appli-ed to build.gradle

/**
 * JIB PLUGIN
 *
 * Jib creates Docker images for Spring Boot applications
 *
 */

apply plugin: 'com.google.cloud.tools.jib'

jib {
    to {
        image = 'avgorbitregistry.azurecr.io/amlc/aml-controlli-be'
        tags = parseSemantic(version.toString())
    }
    container {
        ports = ['8080']
        environment = [
                SPRING_OUTPUT_ANSI_ENABLED: 'ALWAYS',
                SERVER_PORT: '8080',
        ]
        creationTime = 'USE_CURRENT_TIMESTAMP'
    }
}

publish {
    dependsOn tasks.jib
}
build {
    dependsOn jibDockerBuild
}

/**
 * Parses semantic version into multiple bindable versions
 *
 * Examples
 *
 * <pre>1.0.15</pre>
 * <pre>
 *     1
 *     1.0
 *     1.0.15
 * </pre>
 *
 *
 * <pre>1.4.13-SNAPSHOT</pre>
 * <pre>
 *     1-SNAPSHOT
 *     1.4-SNAPSHOT
 *     1.4.13-SNAPSHOT
 * </pre>
 *
 * @param version
 */
static def parseSemantic(String version) {
    int indexOfDash = version.indexOf('-')
    def versionType = indexOfDash < 0 ? '' : version.substring(indexOfDash)
    def ret = []
    for (def indexOfDot = 0; indexOfDot > -1; indexOfDot = version.indexOf('.', indexOfDot + 1)) {
        if (indexOfDot == 0) continue
        ret.push("${version.substring(0, indexOfDot)}$versionType")
    }
    ret.push(version)
    ret.push("latest${versionType}")
    ret
}


task jibDisplaySemanticVersions {
    description 'Prints semantic versions for Docker tags'
    group 'jib'
    doLast {
        parseSemantic(version.toString()).forEach {
            println "Version >> $it"
        }
    }
}

Log output:

Welcome to Gradle 7.4.1!

Here are the highlights of this release:
 - Aggregated test and JaCoCo reports
 - Marking additional test source directories as tests in IntelliJ
 - Support for Adoptium JDKs in Java toolchains

For more details see https://docs.gradle.org/7.4.1/release-notes.html

Starting a Gradle Daemon, 1 incompatible Daemon could not be reused, use --status for details

> Configure project :
Reckoned version: 0.6.0

> Task :jibDockerBuild

Containerizing application to Docker daemon as avgorbitregistry.azurecr.io/amlc/aml-controlli-be, avgorbitregistry.azurecr.io/amlc/aml-controlli-be, avgorbitregistry.azurecr.io/amlc/aml-controlli-be:0.6.0, avgorbitregistry.azurecr.io/amlc/aml-controlli-be:0.6, avgorbitregistry.azurecr.io/amlc/aml-controlli-be:0...
Base image 'eclipse-temurin:11-jre' does not use a specific image digest - build may not be reproducible
The base image requires auth. Trying again for eclipse-temurin:11-jre...
The credential helper (docker-credential-desktop) has nothing for server URL: registry-1.docker.io

Got output:

credentials not found in native keychain

The credential helper (docker-credential-desktop) has nothing for server URL: registry.hub.docker.com

Got output:

credentials not found in native keychain

Using credentials from Docker config (C:\Users\admin\.docker\config.json) for eclipse-temurin:11-jre
Executing tasks:
[============                  ] 40,0% complete
> building image to Docker daemon


> Task :jibDockerBuild FAILED

FAILURE: Build failed with an exception.

* What went wrong:
Execution failed for task ':jibDockerBuild'.
> com.google.cloud.tools.jib.plugins.common.BuildStepsExecutionException: Build to Docker daemon failed, perhaps you should make sure your credentials for 'registry-1.docker.io/library/eclipse-temurin' are set up correctly. See https://github.com/GoogleContainerTools/jib/blob/master/docs/faq.md#what-should-i-do-when-the-registry-responds-with-unauthorized for help

Additional Information:

As I said, I am trying to build avgorbitregistry.azurecr.io/amlc/aml-controlli-be. Here it happens with semantic tagging

To achieve semantic tagging, I employ both Reckon plugin and a custom function, that you see in the code, to compute tags.

The idea is to build multiple tags based on the version computed by Reckon upon the git tags available. Cool, yea? It works in pipelines, but not locally.

My Docker configuration ~\.docker\config.json

{
  "auths": {
    "avgorbitregistry.azurecr.io": {},
    "https://index.docker.io/v1/": {}
  },
  "credsStore": "desktop",
  "currentContext": "default",
  "stackOrchestrator": "swarm"
}

In order to login to ACR, I use the following one liner in Powershell

((az acr login  --expose-token --name avgorbitregistry) | ConvertFrom-Json).accessToken | docker login avgorbitregistry.azurecr.io -u 00000000-0000-0000-0000-000000000000 --password-stdin

At this moment, while I don’t need any pushing, I don’t need to be logged into ACR. I can still log in to Docker Hub with my account by hitting Sign In on Docker Desktop, but the error persists. Note The credential helper (docker-credential-desktop) has nothing for server URL: registry.hub.docker.com

Got output:

credentials not found in native keychain

The credential helper (docker-credential-desktop) has nothing for server URL: registry.hub.docker.com                                                                                                                                   
                                                                                                                                                                                                                                        
Got output:                                                                                                                                                                                                                             
                                                                                                                                                                                                                                        
credentials not found in native keychain

Using credentials from Docker config (C:\Users\admin\.docker\config.json) for eclipse-temurin:11-jre 

Thanks to you for the time spent on this issue

[chanseokoh]

I don’t know why docker pull doesn’t work on wire connection. There might be some firewall or proxy or something intervening in your network?

In any case, I missed this earlier:

Using credentials from Docker config (C:\Users\admin\.docker\config.json) for eclipse-temurin:11-jre

Jib asks the docker-credential-desktop CLI to return credentials for registry-1.docker.io, registry.hub.docker.com, index.docker.io, and docker.io in turn.

trying docker-credential-desktop for registry-1.docker.io
The credential helper (docker-credential-desktop) has nothing for server URL: registry-1.docker.io
trying docker-credential-desktop for registry.hub.docker.com
The credential helper (docker-credential-desktop) has nothing for server URL: registry.hub.docker.com
trying docker-credential-desktop for index.docker.io
Using credentials from Docker config (C:\Users\admin\.docker\config.json) for eclipse-temurin:11-jre

It must be that the desktop cred helper does store non-working credentials for index.docker.io.

Remove "credsStore": "desktop" (or make the file empty or just delete it) and try again.

[djechelon]

It worked for me by removing the credsStore node selectively. Wiping the whole file resulted in its recreation.