Docker Registry different Auth same Registry

[Djcd]

Hi,

i would like to ask, if you know any possibility to configure the following:

I have a private docker registry (quay based) with two different paths. The paths have different authentifications, so i tested it out like this

{
  hostType: "docker",
  hostName/domainName/baseUrl: "registry.example.com/path1/",
  username: process.env.DOCKER_USER_1,
  password: process.env.DOCKER_PASSWORD_1
},
{
  hostType: "docker",
  hostName/domainName/baseUrl: "registry.example.com/path2/",
  username: process.env.DOCKER_USER_2,
  password: process.env.DOCKER_PASSWORD_2
}

If i use the config with

{
  hostType: "docker",
  hostName: "registry.example.com",
  username: process.env.DOCKER_USER_1,
  password: process.env.DOCKER_PASSWORD_1
}

it works like it should, but only with path1 images.

Hopefully someone has an idea how to handle this 😃 .

Kind regards and thanks in advance!

[viceice]

Try this:

{
  hostType: "docker",
  baseUrl: "https://registry.example.com/v2/path1/",
  username: process.env.DOCKER_USER_1,
  password: process.env.DOCKER_PASSWORD_1
},
{
  hostType: "docker",
  baseUrl: "https://registry.example.com/v2/path2/",
  username: process.env.DOCKER_USER_2,
  password: process.env.DOCKER_PASSWORD_2
}

baseUrl need full url prefix. I think it also needs v2/ path prefix

this should work for following images:

• registry.example.com/path1/image1
• registry.example.com/path2/image5

[viceice]

If you check the DEBUG log you would see the requested failed urls. 😉

[Djcd]

Hi viceice,

thanks for the fast answer :). Just tried it out with those settings, but no success.

{
  hostType: "docker",
  baseUrl: "https://registry.sora.internal/v2/base/",
  username: process.env.DOCKER_USER_1,
  password: process.env.DOCKER_PASSWORD_1
},
{
  hostType: "docker",
  baseUrl: "https://registry.sora.internal/v2/comps/",
  username: process.env.DOCKER_USER_2,
  password: process.env.DOCKER_PASSWORD_2
}

The image is set on a gitlab ci yaml file : registry.sora.internal/comps/renovate:24.27.0

I get the following debug logs:

DEBUG: baseBranch: dev (repository=test/renovate-test)
DEBUG: Datasource unauthorized (repository=test/renovate-test)
"datasource": "docker",
"lookupName": "registry.sora.internal/comps/renovate",
"url": "https://registry.sora.internal/v2/comps/renovate/tags/list?n=10000"
DEBUG: Failed to look up dependency registry.sora.internal/comps/renovate (repository=test/renovate-test, packageFile=.gitlab-ci.yml, dependency=registry.sora.internal/comps/renovate)
DEBUG: Failed to look up dependency registry.sora.internal/comps/renovate (repository=test/renovate-test, packageFile=.gitlab-ci.yml, dependency=registry.sora.internal/comps/renovate)
DEBUG: Package releases lookups complete (repository=test/renovate-test)
"baseBranch": "dev"
DEBUG: packageFiles with updates (repository=test/renovate-test)
"config": {
"gitlabci": [
{
"packageFile": ".gitlab-ci.yml",
"deps": [
{
"depName": "registry.sora.internal/comps/renovate",
"currentValue": "24.27.0",
"replaceString": "registry.sora.internal/comps/renovate:24.27.0",
"autoReplaceStringTemplate": "{{depName}}{{#if newValue}}:{{newValue}}{{/if}}{{#if newDigest}}@{{newDigest}}{{/if}}",
"datasource": "docker",
"depType": "image",
"depIndex": 0,
"updates": [],
"warnings": [
{
"depName": "registry.sora.internal/comps/renovate",
"message": "Failed to look up dependency registry.sora.internal/comps/renovate"
}
],
"fixedVersion": "24.27.0"
},
{
"depName": "registry.sora.internal/comps/renovate",
"currentValue": "24.27.0",
"replaceString": "registry.sora.internal/comps/renovate:24.27.0",
"autoReplaceStringTemplate": "{{depName}}{{#if newValue}}:{{newValue}}{{/if}}{{#if newDigest}}@{{newDigest}}{{/if}}",
"datasource": "docker",
"depType": "image",
"depIndex": 1,
"updates": [],
"warnings": [
{
"depName": "registry.sora.internal/comps/renovate",
"message": "Failed to look up dependency registry.sora.internal/comps/renovate"
}
],
"fixedVersion": "24.27.0"
}
]
}
]
}

If i use only

{
  hostType: "docker",
  hostName: "registry.sora.internal",
  username: process.env.DOCKER_USER_2,
  password: process.env.DOCKER_PASSWORD_2
}

it works:

DEBUG: baseBranch: dev (repository=test/renovate-test)
DEBUG: getLabels(https://registry.sora.internal, comps/renovate, 24.27.0) (repository=test/renovate-test)
DEBUG: getManifestResponse(https://registry.sora.internal, comps/renovate, 24.27.0) (repository=test/renovate-test)
DEBUG: found labels in manifest (repository=test/renovate-test)
"labels": {
"maintainer": "Rhys Arkins [email protected]",
"name": "renovate",
"org.opencontainers.image.licenses": "AGPL-3.0-only",
"org.opencontainers.image.source": "https://github.com/renovatebot/renovate",
"org.opencontainers.image.url": "https://renovatebot.com",
"org.opencontainers.image.version": "24.27.0"
}
DEBUG: getDigest(https://registry.sora.internal, comps/renovate, 24.27.0) (repository=test/renovate-test)
DEBUG: getDigest(https://registry.sora.internal, comps/renovate, 24.27.0) (repository=test/renovate-test)
DEBUG: getManifestResponse(https://registry.sora.internal, comps/renovate, 24.27.0) (repository=test/renovate-test)
DEBUG: getManifestResponse(https://registry.sora.internal, comps/renovate, 24.27.0) (repository=test/renovate-test)
DEBUG: Got docker digest (repository=test/renovate-test)
"digest": "sha256:fd3f9c1ec0d275df7c82b568488866484a84c8f32962847771e747011085beb2"
DEBUG: Got docker digest (repository=test/renovate-test)
"digest": "sha256:fd3f9c1ec0d275df7c82b568488866484a84c8f32962847771e747011085beb2"
DEBUG: Package releases lookups complete (repository=test/renovate-test)
"baseBranch": "dev"
DEBUG: packageFiles with updates (repository=test/renovate-test)
"config": {
"gitlabci": [
{
"packageFile": ".gitlab-ci.yml",
"deps": [
{
"depName": "registry.sora.internal/comp/renovate",
"currentValue": "24.27.0",
"replaceString": "registry.sora.internal/comp/renovate:24.27.0",
"autoReplaceStringTemplate": "{{depName}}{{#if newValue}}:{{newValue}}{{/if}}{{#if newDigest}}@{{newDigest}}{{/if}}",
"datasource": "docker",
"depType": "image",
"depIndex": 0,
"updates": [
{
"updateType": "pin",
"newValue": "24.27.0",
"newVersion": "24.27.0",
"newDigest": "sha256:fd3f9c1ec0d275df7c82b568488866484a84c8f32962847771e747011085beb2",
"newDigestShort": "fd3f9c1"
}
],
"warnings": [],
"fixedVersion": "24.27.0",
"sourceUrl": "https://github.com/renovatebot/renovate",
"dockerRegistry": "https://registry.sora.internal",
"dockerRepository": "comp/renovate"
},
{
"depName": "registry.sora.internal/comp/renovate",
"currentValue": "24.27.0",
"replaceString": "registry.sora.internal/comp/renovate:24.27.0",
"autoReplaceStringTemplate": "{{depName}}{{#if newValue}}:{{newValue}}{{/if}}{{#if newDigest}}@{{newDigest}}{{/if}}",
"datasource": "docker",
"depType": "image",
"depIndex": 1,
"updates": [
{
"updateType": "pin",
"newValue": "24.27.0",
"newVersion": "24.27.0",
"newDigest": "sha256:fd3f9c1ec0d275df7c82b568488866484a84c8f32962847771e747011085beb2",
"newDigestShort": "fd3f9c1"
}
],
"warnings": [],
"fixedVersion": "24.27.0",
"sourceUrl": "https://github.com/renovatebot/renovate",
"dockerRegistry": "https://registry.sora.internal",
"dockerRepository": "comp/renovate"
}
]
}
]
}

Thanks in advance for further help and sorry for the long debug log, but it is always about the details 😄

[rarkins]

Perhaps there's a different URL that's used for obtaining the token and it's (a) common for both, (b) not covered by either baseUrl.

[viceice]

@Djcd can you do a curl to https://registry.sora.internal/v2/ and past the returning headers here?

I think docker doesn't support different credentials for a single domain. So your best option is to add allow renovate bot user readonly access to the registry

[Djcd]

Hi rarkins, hi viceice,

yes seems like. I think it is not possible at the moment to do this, only chance is to define a read only account which has access to both paths.

curl -I https://registry.sora.internal/v2/
HTTP/2 401
server: nginx/1.12.1
date: Tue, 26 Jan 2021 14:14:22 GMT
content-type: text/html; charset=utf-8
content-length: 4
docker-distribution-api-version: registry/2.0
www-authenticate: Bearer realm="https://registry.sora.internal/v2/auth",service="registry.sora.internal"

Anyways, thanks for the help! 👍