Cloudron makes it easy to run web apps like WordPress, Nextcloud, GitLab on your server. Find out more or install now.


  • Categories
  • Recent
  • Tags
  • Popular
  • Bookmarks
Skins
  • Light
  • Cerulean
  • Cosmo
  • Flatly
  • Journal
  • Litera
  • Lumen
  • Lux
  • Materia
  • Minty
  • Morph
  • Pulse
  • Sandstone
  • Simplex
  • Sketchy
  • Spacelab
  • United
  • Yeti
  • Zephyr
  • Dark
  • Cyborg
  • Darkly
  • Quartz
  • Slate
  • Solar
  • Superhero
  • Vapor

  • Default (No Skin)
  • No Skin
Collapse

Cloudron Forum

Apps | Demo | Docs | Install

Cannot install apps from docker-registry because authentication fails

Scheduled Pinned Locked Moved Solved Docker Registry
dockerregistryauthentication
19 Posts 7 Posters 1.1k Views
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • girishG Offline
    girishG Offline
    girish Staff
    wrote on last edited by
    #5

    Looks to be something with the node module (dockerode) we use. It seems to work fine with docker.io private registry just not this custom registry app we have. Have to debug tomorrow.

    1 Reply Last reply
    1
  • girishG Offline
    girishG Offline
    girish Staff
    wrote on last edited by girish
    #6

    @msbt Found the problem after much debugging. It seems there is some special code that changes the UA string depending on the client. So, the proxyAuth addon does not allow dockerode to authenticate properly.

    https://git.cloudron.io/cloudron/box/-/commit/1d0ad3cb47f85b05eabb31853c8c3a585d06c2e9 is the fix. It's really just changing docker-client to docker. If you apply the patch, restart the box code and also go to Docker registry app -> Location -> Save to regenerate the nginx config.

    M J 2 Replies Last reply
    4
  • M Offline
    M Offline
    msbt App Dev
    replied to girish on last edited by
    #7

    @girish nice, great find! I'll check it out tomorrow

    1 Reply Last reply
    0
  • M Offline
    M Offline
    msbt App Dev
    wrote on last edited by
    #8

    looking good @girish, just made those changes and did a cloudron install, worked like a charm!

    1 Reply Last reply
    0
  • ? Offline
    ? Offline
    A Former User
    wrote on last edited by A Former User
    #9

    I'm having this exact same issue with a newly installed docker registry. I checked that particular box file but it has definitely made it into the current release. Is there anything I'm missing?

    Nevermind... it was my bad.

    doodlemania2D 1 Reply Last reply
    1
  • doodlemania2D Offline
    doodlemania2D Offline
    doodlemania2 App Dev
    replied to A Former User on last edited by
    #10

    @atrilahiji What was your resolution? I'm getting it as well.
    Registry is local to my cloudron I'm installing from.
    Getting 500 from cloudron update and logs showing (on the app side) grabbing with auth failing. Some switch I need to throw?

    1 Reply Last reply
    0
  • J Offline
    J Offline
    jk
    replied to girish on last edited by jk
    #11

    @girish Sorry for reopening this after quite a while.

    If have the exact same problem when I am not using the docker client, but the RedHat-built containers projects (podman / skopeo / buildah / etc).

    The solution is the exact same patch, but then with container instead of docker. I tried to create a pull request for it, but apparently I have no right to fork the box code and make one.

    Either way, on my server, the code looks like this now:

    in nginxcoonfig.ejs:

        location @proxy-auth-login {
            if ($http_user_agent ~* "docker") {
                return 401;
            }
            if ($http_user_agent ~* "container") {
                return 401;
            }
            return 302 /login?redirect=$request_uri;
        }
    

    in proxyauth.js

    function isBrowser(req) {
        const userAgent = req.get('user-agent');
        if (!userAgent) return false;
    
        // https://github.com/docker/engine/blob/master/dockerversion/useragent.go#L18
        return !userAgent.toLowerCase().includes('docker') && !userAgent.toLowerCase().includes('container');
    }
    

    Would it be possible to patch this too with the next box release?

    girishG 2 Replies Last reply
    1
  • girishG Offline
    girishG Offline
    girish Staff
    replied to jk on last edited by
    #12

    @jk thanks! I have applied the patch.

    1 Reply Last reply
    1
  • girishG Offline
    girishG Offline
    girish Staff
    replied to jk on last edited by
    #13

    @jk This is you right https://git.cloudron.io/admin/users/jacobkiers ? I have fixed up your permissions on gitlab.

    J 1 Reply Last reply
    0
  • J Offline
    J Offline
    jk
    replied to girish on last edited by
    #14

    @girish Yes, that's me. Thanks!

    J 1 Reply Last reply
    0
  • J Offline
    J Offline
    jk
    replied to jk on last edited by jk
    #15

    @girish Is there any update on when a new box will be released?

    I've been waiting to upgrade because I don't want to lose these changes.

    Sadly, that also means that apps are not automatically upgraded any more, which is somewhat annoying.

    girishG 1 Reply Last reply
    0
  • girishG Offline
    girishG Offline
    girish Staff
    replied to jk on last edited by
    #16

    @jk the next release 6.4 will contain the change. The patch is already in - https://git.cloudron.io/cloudron/box/-/commit/85e3e4b955 . We are still working on 6.4 features - https://forum.cloudron.io/topic/5319/what-s-coming-in-6-4 . You can track the progress there. No intermediate release between now and 6.4 is planned.

    1 Reply Last reply
    0
  • O Offline
    O Offline
    ochoseis
    wrote on last edited by ochoseis
    #17

    Edit 2: I just rebooted and installed a new instance of the Docker Registry app, which seemed to pick up the fixes from the template at /home/yellowtent/box/src/nginxconfig.ejs (it had been a while since I last rebooted), but I don't see the fix on the existing installations' nginx configs under /etc/nginx/applications. Just wanted to see if that's working as intended? I.e. to catch a bugfix in the nginx config it seems like you need to install a new instance of an app after rebooting.

    Edit: I just reread the thread above and it seems like the below issue should've been fixed in Cloudron v6.4/v7.0. I'm on v7.0.4 w/ Docker Registry 2.7.1 (Registry UI 2.1.0) and com.docker.registry@1.4.0. After logging into the box I can see the updates in /home/yellowtent/box/src/proxyauth.js but not in the apps' nginx configs under /etc/nginx/applications. Do I need to do anything to pick up the fixes for the nginx configs?

    Original post:
    I arrived at this thread because I was having trouble using podman to push and pull an images to the Docker Registry app with Cloudron user management turned on. podman shows the following error when I attempt to pull the image, and the < hinted at a redirect to an HTML page:

    $ podman pull images.mycloudrondomain/debian
    
    Error: initializing image from source docker://images.mycloudrondomain/debian:latest: invalid character '<' looking for beginning of value
    

    I am able to push and pull images on a different instance of the app where I disabled auth.

    From the nginx access logs on my server and the source, it looks like podman sets a user agent of containers/{version} (github.com/containers/image). Would it be possible to include containers in the user-agent checks above?

    girishG 1 Reply Last reply
    0
  • girishG Offline
    girishG Offline
    girish Staff
    replied to ochoseis on last edited by
    #18

    @ochoseis thanks for debugging! If I understand you correctly, the nginx config does not have the block below for you ?

        location @proxy-auth-login {
            if ($http_user_agent ~* "docker") {
                return 401;
            }
            if ($http_user_agent ~* "container") {
                return 401;
            }
            return 302 /login?redirect=$request_uri;
        }
    

    For this, go to Location section of the app and click save without making any changes. This re-generates the nginx config. In 7.1, we re-generate all the nginx configs, so this would get fixed if you update to 7.1 as well.

    (This is a bug in Cloudron because we don't version these nginx configs. When we change the nginx template, currently, we have not mechanism to regenerate the nginx configs of apps. We have an issue to fix this though).

    O 1 Reply Last reply
    1
  • O Offline
    O Offline
    ochoseis
    replied to girish on last edited by
    #19

    @girish Thanks -- you summed up the bug I noticed, and I'll be sure to try the Location-save workaround if I run into any nginx issues in the future.

    1 Reply Last reply
    0
  • jadudmJ jadudm referenced this topic on

  • Login

  • Don't have an account? Register

  • Login or register to search.
  • First post
    Last post
0
  • Categories
  • Recent
  • Tags
  • Popular
  • Bookmarks