Authentication not working with ostree container unencapsulate

[javipolo]

When trying to run container unencapsulate in a private repo, I get unauthorized: access to the requested resource is not authorized

[root@sno ~]# oci_url=quay.io/whatever/ost:backup
[root@sno ~]# ostree container unencapsulate --repo /ostree/repo ostree-unverified-registry:$oci_url
error: Creating importer: Failed to invoke skopeo proxy method OpenImage: remote error: reading manifest backup in quay.io/whatever/ost: unauthorized: access to the requested resource is not authorized

When trying with podman, I have no problems pulling the image using /etc/ostree/auth.json:

[root@sno ~]# podman pull --authfile /etc/ostree/auth.json $oci_url
Trying to pull quay.io/whatever/ost:backup...
Getting image source signatures
Copying blob 346d2d8b7e27 done  
Copying config 09a563fade done  
Writing manifest to image destination
Storing signatures
09a563fade9b04e3ab59e1b8246daa9d55a7011357921c48d913e82c8082759e

# Check /etc/ostree/auth.json file permissions
[root@sno ~]# ls -ld /etc/ostree/auth.json 
-rw-------. 1 root root 97 Aug 28 12:12 /etc/ostree/auth.json

I have tried both /etc/ostree/auth.json and $HOME/.docker/config.json and none works. Also running strace I've seen that ostree does open /etc/ostree/auth.json

In the end, the only authentication file that is being used is the one set as global_auth_file in crio configuration (that in my case happens to be /var/lib/kubelet/config.json)

It be cool if container unencapsulate could have an --authfile flag as container image deploy has

[cgwalters]

PR in ostreedev/ostree-rs-ext#519

[cgwalters]

A workaround today is likely env REGISTRY_AUTH_FILE=/path/to/auth.json ostree container unencapsulate ....

[javipolo]

Thanks for the quick response 🚀 !!

The workaround seems to work for encapsulate but not for unencapsulate:

unencapsulate

[root@sno ~]# REGISTRY_AUTH_FILE=/var/tmp/backup-secret.json ostree container unencapsulate --repo /ostree/repo ostree-unverified-registry:quay.io/whatever/ost:backup --write-ref backup
error: Creating importer: Failed to invoke skopeo proxy method OpenImage: remote error: reading manifest backup in quay.io/whatever/ost: unauthorized: access to the requested resource is not authorized

encapsulate

[root@sno ~]# REGISTRY_AUTH_FILE=/var/tmp/backup-secret.json ostree container encapsulate --repo /ostree/repo test registry:quay.io/whatever/ost:test
sha256:a6136f83c32872489feec8daa9d10654888861f1e1dd6237d40f503780a22e05

[cgwalters]

For encapsulate, you can work around this by pushing to an oci directory, and then using skopeo copy oci:... docker://.

[javipolo]

For encapsulate, you can work around this by pushing to an oci directory, and then using skopeo copy oci:... docker://.

The workaround does work with encapsulate, it is with unencapsulate that is not working 😅

[cgwalters]

And ostreedev/ostree-rs-ext#523 is the other half.