Alano Terblanche fd4dae8351 feat(registry): use the Docker Desktop Hub session for Docker Hub credentials ...

Docker Hub credentials are now read first from the session of the account signed in to Docker Desktop, through the Docker Desktop secrets engine (github.com/docker/secrets-engine/client), and from the Docker CLI config file and its credential helpers otherwise. Other registries keep using the config file only.

The OAuth access token is passed as the password of the signed-in account, never as an IdentityToken, which containerd sends as a refresh token. It flows unchanged to the engine in X-Registry-Auth and through the OCI resolver as an OAuth password grant.

Compose falls back to the config file when Desktop is not running, nobody is signed in, the session is expired or about to expire, or the lookup fails (the last logged as a warning). The session is shared process wide, cached until shortly before it expires, and an unusable session is not asked for again. Lookups are bounded by a 5s timeout, as the SDK applies none by default.

Used by pull, push, publish, config --resolve-image-digests, oci:// remote resources and dry-run. The classic builder and use_api_socket keep config file credentials, as a short-lived token copied into a container would go stale.

Signed-off-by: Alano Terblanche <[email protected]>

2026-10-07 14:24:28 +02:00

..

dryrunclient_test.go

fix(dry-run): commit no longer creates a real image; the interception set becomes declarative

2026-09-16 13:44:21 +02:00

dryrunclient.go

feat(registry): use the Docker Desktop Hub session for Docker Hub credentials

2026-10-07 14:24:28 +02:00