Sree Raghav's Blog

Login to Docker Hub via Command Line

Sree Raghav's photo
Sree Raghav
·

3 min read

At the Linux prompt type as shown:

root@u22:~# docker login --help

Usage:  docker login [OPTIONS] [SERVER]

Log in to a registry.
If no server is specified, the default is defined by the daemon.

Options:
  -p, --password string   Password
      --password-stdin    Take the password from stdin
  -u, --username string   Username

From the usage directive, we figured it that -p and -u are optional. So the easy way is:

root@u22:~# docker login
Login with your Docker ID to push and pull images from Docker Hub. If you don't have a Docker ID, head over to https://hub.docker.com to create one.
Username: sreeraghav
Password:
WARNING! Your password will be stored unencrypted in /root/.docker/config.json.
Configure a credential helper to remove this warning. See
https://docs.docker.com/engine/reference/commandline/login/#credentials-store

Login Succeeded

What's this message all about?

WARNING! Your password will be stored unencrypted in /root/.docker/config.json. Configure a credential helper to remove this warning. See https://docs.docker.com/engine/reference/commandline/login/#credentials-store

Your password is stored Unencrypted and in Base64 format.

Within the URL anyone can just convert the Base64 string to text:

https://base64.guru/converter/decode/text

How to decode?

First, find the Base64 string

root@u22:~# cat /root/.docker/config.json
{
        "auths": {
                "https://index.docker.io/v1/": {
                        "auth": "c3JlZXJhZ2hhdjpSYW1Sb2JlcnRSYWhpbQ=="
                }
        }
}

Decode the Base64 String:

https://base64.guru/converter/decode/text

How to safeguard your password?

  • Using Credential store

Credentials store

The Docker Engine can keep user credentials in an external credentials store, such as the native keychain of the operating system. Using an external store is more secure than storing credentials in the Docker configuration file.

This is the list of currently available credentials helpers and where you can download them from:

I currently chose to use a pass:

pass: https://github.com/docker/docker-credential-helpers/releases

How to set it up?

# Install the standard Unix password manager.
root@u22:~# sudo apt-get install pass

# Download and install docker-credential-pass.
root@u22:~# wget https://github.com/docker/docker-credential-helpers/releases/download/v0.6.3/docker-credential-pass-v0.6.3-amd64.tar.gz

root@u22:~# tar -xvf docker-credential-pass-v0.6.3-amd64.tar.gz

# Move the docker-credential-pass to the $PATH.
# Docker requires the helper program to be in the client’s host $PATH.
root@u22:~# sudo mv docker-credential-pass /usr/bin/
root@u22:~# chmod +x /usr/bin/docker-credential-pass

# Observe that Docker credentials helper have no credentials saved yet.
root@u22:~# docker-credential-pass list
{}

# Generate encryption keys.
root@u22:~# gpg --generate-key
gpg (GnuPG) 2.2.19; Copyright (C) 2019 Free Software Foundation, Inc.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

GnuPG needs to construct a user ID to identify your key.

Real name: sreeraghav
Email address: sreeraghav.myself@gmail.com
You selected this USER-ID:
    "sreeraghav <sreeraghav.myself@gmail.com>"

Change (N)ame, (E)mail, or (O)kay/(Q)uit? O
# Following the instruction to reate the password to the user ID. 

# Initialize the password manager for the encryption key.
root@u22:~# pass init sreeraghav.myself@gmail.com
mkdir: created directory '/root/.password-store/'
Password store initialized for sreeraghav.myself@gmail.com

root@u22:~# cat /root/.password-store/.gpg-id 
sreeraghav.myself@gmail.com

# Add "credsStore": "pass" to the JSON file, so that Docker knows it has to use docker-credential-pass to manage credentials.
root@u22:~# nano ~/.docker/config.json
"credsStore": "pass"

# You can login safely.
root@u22:~# docker login
Login with your Docker ID to push and pull images from Docker Hub. If you don't have a Docker ID, head over to https://hub.docker.com to create one.
Username: sreeraghav 
Password: 
Login Succeeded

root@u22:~# docker-credential-pass list
{"https://index.docker.io/v1/":"sreeraghav"}

# The password is no longer saved in the Docker configuration.
root@u22:~# cat ~/.docker/config.json
root@u22:~# cat ~/.docker/config.json
{
        "auths": {
                "https://index.docker.io/v1/": {}
        },
        "credsStore": "pass"
Docker Credential StoreDocker Credential Store How to use pass