Using Build context to fetch a private image from GHCR

[OttoHung]

Hi,
I experimented to understand how Buildx uses the --build-context flag to fetch a private docker image from GHCR. Then I found Buildx can download the docker image from GHCR without being configured with any access token. I wonder how Buildx fetches a private docker image?

Also, I use --build-context to fetch a private git repository from GitHub and Buildx encounters the authentication issue as expected.

I saw two different behaviours by accessing the private registry and repository so I would like to know if this is common and how it makes it.

My test script is here and the private docker image is here.

Please feel free to let me know if this is an appropriate question. Thank you very much.

Have a good one.

Note:
The private docker image means the visibility of this image is private on GHCR.
I did the test of removing PAT from ~/.npmrc then Buildx still can fetch the private docker image.

[jedevc]

Buildx will fetch your private image from GHCR if your .docker/config.json is configured with authentication credentials or a credentials helper to allow pulling from GHCR. This is pretty much identical to the mechanism used to do a docker pull.

I've answered the git repository question in the other discussion you opened here

[OttoHung]

Hi @jedevc ,
Thank you for the quick reply. I didn't configure .docker/config.json file in my local project folder, but I can find it at ~/.docker.

I just cat this file, it looks like there is no authentication credential configured as following:

{
  "auths": {
    "ghcr.io": {}
  },
  "credsStore": "desktop"
}

Are there other places that could have the crednetial? From my understanding, I configured ~/.npmrc to fetch npm packages from GitHub only.

[crazy-max]

Use docker login ghcr.io and it should be populated.

[OttoHung]

Hi @crazy-max,
Thank you for the reply. I used docker login ghcr.io with my PAT as echo $TOKEN | docker login ghcr.io -u ottohung --password-stdin. Then I got the same content by cating ~/.docker/config.json as follows:

{
        "auths": {
                "ghcr.io": {}
        },
        "credsStore": "desktop"
}

I use macOS for ths practice. Not quite sure what the problem is.

I tried to fetch private image and it works without docker login. If docker deamon uses docker CLI or other API to download the image, I think I may need to shoot this question to GitHub for declaration.

Thanks again.

Have a good one.

[wibed]

anyone found a way to force buildx to use available credentials

[zvi-quantivly]

Facing the same issue, can't get buildx to pull a private image from ghcr.io.
My workflow includes:

env:
  REGISTRY: "ghcr.io"
...
    steps:
      - name: Login to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

and the build-push-action includes:

      - name: Build <org>/<repo>
        uses: docker/build-push-action@v5
        with:
          context: .
          file: "${{ github.workspace }}/path/to/Dockerfile"
          build-contexts: |
            <base-reference>=${{ env.REGISTRY }}/<base-reference>
          cache-from: type=gha
          cache-to: type=gha,mode=max
          push: true

The FROM target in the build-contexts configuration (ghcr.io//:) is definitely built and pushed successfully, but I keep getting:

Error: buildx failed with: ERROR: failed to get build context <base-reference>: stat ghcr.io/<base-reference>: no such file or directory

I tried many things, including adding a manual docker login ghcr.io step to make sure .docker/config.json is updated, but it didn't help.
Any help resolving this would be greatly appreciated.

[krupesh1958]

Perhaps this approach will assist you.

You must first obtain CR_PAT (container registery personal access token) in order to pull or use a private image into your GHCR. You are unable to pull any private packages from GHCR without PAT.

To establish a new CR_PAT, take the following actions:

-> Settings / Developer Settings / Tokens (classic) ----> Generate new CR_PAT.
We must convert CR_PAT into base64 with a username after it has been produced.

echo -n "USERNAME:CR_PAT" | base64
>>> GENERATED_TOKEN

Simply copy the token into the Docker config.json file after obtaining the token.

nano ~/.docker/config.json

Replace your code within this one,

{
	"auths": {
		"ghcr.io": {
			"auth": "GENERATED_TOKEN"
		},
	},
	"credsStore": "desktop",
	"currentContext": "desktop-linux"
}

Note: You should replace GENERATED_TOKEN.

[WeshKenny]

how can i use base64 on windows?

[krupesh1958]

If you are unable to accomplish this using Power Shell, I advise using code instead.
The Python code is as follows:

import base64

original_string = "USERNAMECR_PAT"

# Base64 should be used after the original string has been encoded into bytes. 
base64_encoded = base64.b64encode(original_string.encode()).decode()

print(base64_encoded)

To accomplish this on Power Shell, use this command: [Convert]::ToBase64String([Text.Encoding]::UTF8.GetBytes("USERNAME:CR_PAT"))

[andreswebs]

This here works for me:

{
    "credsStore": "desktop",
    "currentContext": "desktop-linux",
    "credHelpers": {
        "ghcr.io": "gh"
    }
}

You need to have the GitHub CLI (gh) installed and in your PATH, and have authenticated through the CLI.