module

Krikri::PluginHelpers::DockerLogin

DockerLogin - pure logic for the docker_login plugin: docker config.json auth-entry handling (the Ansible module's DockerFileStore.get/store/erase semantics: base64 "user:pass" entries under auths[<registry>], config rewritten 0600) and login command construction. Split out so this logic is unit-spec-able (execution needs a real registry/docker CLI).

Constants

DEFAULT_CONFIG_PATH = "~/.docker/config.json"
DEFAULT_REGISTRY_URL = "https://index.docker.io/v1/"

Class methods

decode_auth(auth : String | Nil) : NamedTuple(username: String, password: String) | Nil

Decodes an auths[server]["auth"] entry ("user:pass", base64). Returns nil for missing/malformed entries.

Source
hub?(registry_url : String) : Bool

The registry key auth entries are stored under. Docker's CLI stores hub credentials under the legacy hub endpoint; passing the default hub URL to docker login is also how the CLI gets invoked without an explicit registry argument.

Source
login_command(registry_url : String, username : String, password : String, config_dir : String | Nil) : String

docker login command for the registry. Hub default logins omit the registry argument (the CLI's own default), everything else passes the URL; --config points the CLI at the config file's directory for custom config_path support.

The password travels via --password-stdin, base64-framed in the command string: docker login -p <pw> puts the cleartext credential in the remote process's argv, readable from /proc/<pid>/cmdline by any local user for the login's duration. The base64 form keeps it out of argv entirely (same framing the batch transport and postgresql_db's .pgpass staging use).

Source
missing_credentials_msg(username : String | Nil, password : String | Nil) : String | Nil

The Ansible module's required_if failure message for state=present.

Source
stored_credentials(config : JSON::Any | Nil, registry_url : String) : NamedTuple(username: String, password: String) | Nil

Current stored credentials for the registry from the parsed config, or nil.

Source
with_erased_credentials(config : JSON::Any | Nil, registry_url : String) : String | Nil

New config JSON string with the registry's auth entry removed.

Source
with_stored_credentials(config : JSON::Any | Nil, registry_url : String, username : String, password : String) : String

New config JSON string with the registry's auth entry stored (auth = base64 "user:pass"). Non-auths keys are preserved.

Source