quarkus jib: Using a different config.json for separate registry namepaces?

[joes]

Hi all,

I am encountering the problem described in the below issue which is related to authentication to container registries in different namespaces on the same registry host:

moby/moby#37569

Specifically, $HOME/.docker/config.json (and any credentials helper used by docker) does not support multiple logins for the same registry in different namespaces/paths. In config.json docker just stores the domain, not the full url for an auth:

1. docker login -u team1user gitlab.somewhere.com:5050/team1/registry
   • an auth is stored in $HOME/.docker/config.json for the host gitlab.somewhere.com:5050 without the provided namespace/path in the url.
2. docker login -u team2user gitlab.somewhere.com:5050/team2/registry
   • Docker interprets this as a login attempt to the registry gitlab.somewhere.com:5050 (without the full namespace) and reuses the auth stored at 1. However, this auth is not authorized for pulling/pushing images from gitlab.somewhere.com:5050/team2/registry.

A workaround (for some cases) is to use separate config.json:s for separate registry namespaces and set the environment variable DOCKER_CONFIG to the location (directory) for the configuration that is to be used.

This works well with the docker cli but not when used by quarkus as there does not seem to be any option provided to pass this environment variable to docker through quarkus jib (see https://quarkus.io/guides/container-image#jib-options)

Can anyone think of a way to pass on the DOCKER_CONFIG environment to quarkus jib?

Or would one need to implement the dockerClient.environment option from the jib-maven-plugin in order to make this work?

[quarkus-bot[bot]]

/cc @geoand

[geoand]

#25743 is the answer :)

[joes]

Thank you @geoand!

[geoand]

yw!