[BUG] Password lost when stopping and restarting (Synology NAS)

[JimDog546]

Describe the bug
Stopping (docker-compose down) and restarting (docker-compose up -d) causes the password to be lost even though the option to save it in keyring is y.

To Reproduce
Steps to reproduce the behavior:

1. Start with docker-compose up -d
2. Enter password & perform 2FA with docker exec -it --user=abc icloud-docker /bin/sh -c "icloud [email protected] --session-directory=/config/session_data"

Enter iCloud password for [email protected]: 
Save password in keyring? [y/N]: y

Two-step authentication required. 
Please enter validation code
(string) --> ######

4. Optionally wait 10 minutes for login retry. That is successful and files and photos download as expected.
5. Stop with docker-compose down
6. Restart with docker-compose up -d
7. Log shows ERROR :: root :: sync.py :: 116 :: Password is not stored in keyring. Please save the password in keyring. and I receive an email that "Two step authentication is required"

Expected behavior
When restarting with docker-compose up -d the password should be retrieved from keyring.

Screenshots

# docker logs -f icloud-docker

====================================================
To support this project, please consider sponsoring.
https://github.com/sponsors/mandarons
https://www.buymeacoffee.com/mandarons

User UID:    1030
User GID:    100
====================================================

2024-11-21 15:51:24,826 :: ERROR :: root :: sync.py :: 116 :: Password is not stored in keyring. Please save the password in keyring.
2024-11-21 15:51:24,827 :: INFO :: root :: config_parser.py :: 69 :: Retrying login every 600 seconds.
2024-11-21 15:51:24,827 :: INFO :: root :: sync.py :: 126 :: Retrying login at Thu Nov 21 16:01:24 2024 ...
2024-11-21 15:51:24,827 :: WARNING :: root :: config_parser.py :: 406 :: Warning: bot_token is not found in app > telegram > bot_token.
2024-11-21 15:51:24,827 :: WARNING :: root :: config_parser.py :: 419 :: Warning: chat_id is not found in app > telegram > chat_id.
2024-11-21 15:51:24,827 :: WARNING :: root :: notify.py :: 33 :: Not sending 2FA notification because Telegram is not configured.
2024-11-21 15:51:24,827 :: WARNING :: root :: config_parser.py :: 433 :: Warning: webhook_url is not found in app > discord > webhook_url.

Configuration
docker-compose.yml

version: '3'
services:
  icloud-docker:
    image: mandarons/icloud-drive
    environment:
      - PUID=1030
      - PGID=100
      - ENV_CONFIG_FILE_PATH=/config/config.yaml
      - TZ=America/New_York
    container_name: icloud-docker
    restart: unless-stopped
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - /volume1//iCloud:/icloud
      - /volume1/docker/icloud-docker/config:/config # Must contain config.yaml

networks:
  default:
    ipam:
      config:
        - subnet: 172.19.4.0/24
          gateway: 172.19.4.1

config.yaml

app:
  logger:
    # level - debug, info (default), warning or error
    level: "info"
    # log filename icloud.log (default)
    filename: "/config/icloud.log"
  credentials:
    # iCloud drive username
    username: "[email protected]"
    # Retry login interval - default is 10 minutes, specifying -1 will retry login only once and exit
    retry_login_interval: 600
  # Drive destination
  root: "/icloud"
  # discord:
  # webhook_url: <your server webhook URL here>
  # username: icloud-docker #or any other name you prefer
  # telegram:
  # bot_token: <your Telegram bot token>
  # chat_id: <your Telegram user or chat ID>
  smtp:
    ## If you want to receive email notifications about expired/missing 2FA credentials then uncomment
    email: "[email protected]"
    ## optional, to email address. Default is sender email.
    to: "[email protected]"
    password: "<redacted>"
    host: "provider.com"
    port: 587
    # If your email provider doesn't handle TLS
    no_tls: false
  region: global # For China server users, set this to - china (default: global)
drive:
  destination: "drive"
  remove_obsolete: false
  sync_interval: 300
  # filters: # Optional - use it only if you want to download specific folders.
    # File filters to be included in syncing iCloud drive content
    # folders:
      # - "folder1"
      # - "folder2"
      # - "folder3"
    # file_extensions:
      # File extensions to be included
      # - "pdf"
      # - "png"
      # - "jpg"
      # - "jpeg"
  # ignore:
    # When specifying folder paths, append it with /*
    # - "node_modules/*"
    # - "*.md"
photos:
  destination: "photos"
  remove_obsolete: false
  sync_interval: 500
  all_albums: false # Optional, default false. If true preserve album structure. If same photo is in multiple albums creates duplicates on filesystem
  folder_format: "%Y/%m" # optional, if set put photos in subfolders according to format. Format cheatsheet - https://strftime.org
  filters:
    # List of libraries to download. If omitted (default), photos from all libraries (own and shared) are downloaded. If included, photos only
    # from the listed libraries are downloaded.
    # libraries:
    #   - PrimarySync # Name of the own library

    # if all_albums is false - albums list is used as filter-in, if all_albums is true - albums list is used as filter-out
    # if albums list is empty and all_albums is false download all photos to "all" folder. if empty and all_albums is true download all folders
    # albums:
      # - "album 1"
      # - "album2"
    file_sizes: # valid values are original, medium and/or thumb
      - "original"
      # - "medium"
      # - "thumb"
    # extensions: # Optional, media extensions to be included in syncing iCloud Photos content
      # - jpg
      # - heic
      # - png

Additional context
Using Docker on a Synology NAS running DSM 7.2.2-72806 Update 1. I'm starting the container from an SSH session as root (sudo -i after login), but in docker-compose.yml I'm passing the UID & GID of a non-root user named docker (1030:100) that I use for all other containers as well. I haven't used anything with keyring before though so it's possible there is something with my setup or configuration that is causing the issue.

[JimDog546]

Oddly, defining the ENV_ICLOUD_PASSWORD environment variable with any value seems to resolve this issue. I assumed that this environment variable wanted my real Apple ID password and I attempted to test adding it to see if it would fix things, and it did, but I later noticed that I made a mistake in the password. So I replaced it with just the value test and I can still sync without issue when stopping and restarting via docker-compose down and docker-compose up -d. Snippet of my docker-compose.yml now:

    environment:
      - PUID=1030
      - PGID=100
      - ENV_CONFIG_FILE_PATH=/config/config.yaml
      - ENV_ICLOUD_PASSWORD=test
      - TZ=America/New_York

If I remove ENV_ICLOUD_PASSWORD the ERROR :: root :: sync.py :: 116 :: Password is not stored in keyring. Please save the password in keyring. issue returns.

I'm guessing that this isn't normal behavior and that the purpose of ENV_ICLOUD_PASSWORD is to provide your true Apple ID password so I'm not sure what's going on here or if my configuration is sustainable.

[343max]

@JimDog546 From looking at the code it seems the only reason why it's not showing the error message is because it tries to use the password you provided through ENV_ICLOUD_PASSWORD. In my experience it only seems like it's syncing, but probably just failing quietly because the password isn't correct.