App-specific registry credentials - #86
Open
kevinmcconnell wants to merge 6 commits into
Open
Conversation
Add RegistrySettings (username/password) to ApplicationSettings and use them when pulling images. Credentials stored in the settings take precedence over the Docker credential store. The deploy and update commands accept the new credentials with the --registry-username and --registry-password flags. To keep the password out of shell history and terminal logs, it can also be read from stdin with --registry-password-stdin.
When a custom image pull fails with a registry credentials error, return to the image form with username and password fields revealed. The retry keeps the image ref and hostname from the failed attempt. Built-in images are always public, so the app list path keeps its existing error handling. In TUI mode started with --install, the same form appears, and esc quits as usual.
There was a problem hiding this comment.
Pull request overview
Adds app-specific registry authentication for private-image deployment and future pulls.
Changes:
- Detects registry authentication failures and prompts for credentials.
- Adds CLI credential flags, including password input via stdin.
- Persists credentials and adds unit/integration coverage.
Tip
If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or run gh pr ready --undo.
Click "Ready for review" or run gh pr ready to reengage.
Reviewed changes
Copilot reviewed 20 out of 20 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
internal/ui/install.go |
Adds credential retry flow. |
internal/ui/install_test.go |
Tests authentication retries. |
internal/ui/install_image_form.go |
Adds credential fields. |
internal/ui/install_image_form_test.go |
Tests credential submission. |
internal/ui/install_hostname_form.go |
Preserves hostname during retry. |
internal/ui/install_activity.go |
Passes credentials into deployment. |
internal/docker/registry_auth.go |
Generates per-app registry authentication. |
internal/docker/registry_auth_test.go |
Tests authentication generation. |
internal/docker/progress.go |
Propagates pull-stream errors. |
internal/docker/progress_test.go |
Tests stream-error handling. |
internal/docker/errors.go |
Classifies registry authentication errors. |
internal/docker/errors_test.go |
Tests error classification. |
internal/docker/application.go |
Applies credentials during pulls. |
internal/docker/application_settings.go |
Persists registry settings. |
internal/docker/application_settings_test.go |
Tests registry serialization and equality. |
internal/command/update_test.go |
Tests credential updates. |
internal/command/settings_flags.go |
Adds registry CLI flags. |
internal/command/deploy.go |
Builds authenticated deploy settings. |
internal/command/deploy_test.go |
Tests deploy credential flags. |
integration/docker_test.go |
Tests authenticated registry deployment. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+17
to
+21
| if !registry.Empty() { | ||
| return encodeAuthConfig(&authn.AuthConfig{ | ||
| Username: registry.Username, | ||
| Password: registry.Password, | ||
| }) |
containerd wraps transport failures during token fetch in the same "failed to authorize" phrase as credential rejections. A registry outage was therefore classified as an auth error, prompting for credentials instead of reporting the pull failure. Count "failed to authorize" as an auth error only when the message also carries a credential-style status (401, 403, denied).
Stored credentials were sent on every pull, whatever registry hosted the image. Changing an app's image to a different registry would send the old password to the new host. Record the registry host with the credentials, and only apply them to pulls from that host. Other pulls fall back to the Docker credential store or anonymous access, and a private image then triggers the usual credentials prompt.
When an update changes the image's registry, carry over an existing credential field only if the stored credentials already apply to the new image. This stops a password saved for one registry from being sent to a different registry when only one credential flag is given.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Planned, but not yet implemented: