Windows configuration problems for Windows Server 2022

[marceliwac]

Hello,

I've spent about a day on debugging the issue now and I can't seem to be able to get the credentials helper to work on my Windows Server 2022 machine. Crucially, the setup uses the docker installation scripts from here and is set up to run the windows containers. I am not using Docker Desktop or WSL.

I might be missing something obvious, so apologies if that's the case, but it seems that no matter what I try, I keep getting the following error:

Error response from daemon: Head "https://123456789.dkr.ecr...": no basic auth credentials

Steps I followed

1. Downloaded the pre-built binary from Releases page, as instructed.
2. Placed the binary (docker-credential-ecr-login.exe) in C:\ (which is in PATH, running "docker-credential-ecr-login" in powershell shows the correct error message, see below).
3. Configured the ~\.aws\credentials file to a standard format (and confirmed it works with aws cli).
4. Configured the ~\.docker\config.json file to several different formats (see below) and verified that it is indeed the file used for docker configuration (basic auth credentials are placed there when executing aws cli commands, malformed json results in errors when trying to pull the image etc.).
5. Ran docker pull 12345678.dkr.ecr..../myimage to no avail, each time the "no basic auth credentials comes up".

Tested configurations in ~.docker\config.json

credsStore

{
  "credsStore": "ecr-login"
}

credsStore (with empty auths)

{
  "auths": {
    "12345678.dkr.ecr.eu-west-1.amazonaws.com": {}
  },
  "credsStore": "ecr-login"
}

credHelpers

{
  "credHelpers": {
    "12345678.dkr.ecr.eu-west-1.amazonaws.com": "ecr-login"
  }
}

credHelpers (with empty auths)

{
  "auths": {
    "12345678.dkr.ecr.eu-west-1.amazonaws.com": {}
  },
  "credHelpers": {
    "12345678.dkr.ecr.eu-west-1.amazonaws.com": "ecr-login"
  }
}

credsStore and credHelpers

{
  "credHelpers": {
    "12345678.dkr.ecr.eu-west-1.amazonaws.com": "ecr-login"
  },
  "credsStore": "ecr-login"
}

credsStore and credHelpers (with empty auths)

{
  "auths": {
    "12345678.dkr.ecr.eu-west-1.amazonaws.com": {}
  },
  "credHelpers": {
    "12345678.dkr.ecr.eu-west-1.amazonaws.com": "ecr-login"
  },
  "credsStore": "ecr-login"
}

Other things I've tried

• Running the program directly (double click), initially thinking it might be an installer, but that certainly didn't work 🥲. Running it in powershell helped me verify that the executable appears to be working correctly:

PS C:\> .\docker-credential-ecr-login.exe
Usage: docker-credential-ecr-login <store|get|erase|list|version>

• Renaming the docker-credential-ecr-login.exe to ecr-login.exe.

Any help or shared experience would be greatly appreciated!

Error message when running `docker-credential-ecr-login`:

The command docker-credential-ecr-login was not found, but does exist in the current location. Windows PowerShell does not load commands from the current location by default. If you trust this command, instead type: ".\docker-credential-ecr-login". See "get-help about_Command_Precedence" for more details.

[marceliwac]

Update:

I've tried setting the credsStore value to wincred and ecr-login, then logging into ecr via aws cli using the aws ecr get-login-password command passed to docker login and made some further discoveries...

Setting credsStore to wincred and logging in proves that credsStore option from the config is respected and results in the following error (which is to be expected, since I did not install wincred):

PS C:\> aws ecr get-login-password | docker login --username AWS --password-stdin 12345678.dkr.ecr.eu-west-1.amazonaws.com

Error saving credentials: error storing credentials - err: exec: "docker-credential-wincred": executable file not found in %PATH%, out: ``

However, running the docker login command manually with the credsStore set to ecr-login shows a different message:

PS C:\> aws ecr get-login-password | docker login --username AWS --password-stdin 12345678.dkr.ecr.eu-west-1.amazonaws.com

Error saving credentials: error storing credentials - err: exec: "docker-credential-ecr-login": cannot run executable found relative to current directory, out: ``

From there, after some more tweaks, I was able to get this to work. In my case, the problem was related to the program not being accessible from the path for whatever reason.

I've deleted the executable again, re-downloaded it to a new directory: C:\ECR Credentials Helper, then added that directory to the path and placed the executable there. My configuration resides under C:\Users\Administrator.aws and C:\Users\Administrator.docker. I did not use any env variables for the configuration of docker or AWS credentials.

Hopefully, this helps those who stumble upon similar issues!

[marceliwac]

I now managed to resolve the issues I've had with getting the credentials helper to play nicely.

In my case, the issues related to using credentials helper as part of Gitlab CI (via Gitlab Runner binary running on the Windows Server 2022 machine). Because the runner ran under a SYSTEM user, the calls to docker (and therefore docker-credential-ecr-login.exe) were also ran within that system context. This meant that to get it all to work, I had to provide configuration not just for the local user (Users/Administrator), but also the system. Thanks to @Tim-Co's comment in #81, I was able to trace this configuration to C:\Windows\system32\config\systemprofile\.docker\config.json.

The solution to configuring the credentials helper on WIndows Server, where docker runs under the SYSTEM context is therefore:

• Downloading the executable (docker-credential-ecr-login.exe).
• Adding the executable to the SYSTEM path (I used C:\ECRCredentialHelper, which is where I placed the executable).
• Providing corresponding configuration for AWS and Docker in the system profile directory: C:\Windows\system32\config\systemprofile\.docker\config.json