|
 |
3d4e4fd |
% containers-auth.json(5)
|
|
|
3d4e4fd |
|
|
|
3d4e4fd |
# NAME
|
|
|
3d4e4fd |
containers-auth.json - syntax for the registry authentication file
|
|
|
3d4e4fd |
|
|
|
3d4e4fd |
# DESCRIPTION
|
|
|
3d4e4fd |
|
|
|
f207507 |
A credentials file in JSON format used to authenticate against container image registries.
|
|
|
f207507 |
On Linux it is stored at `${XDG_RUNTIME_DIR}/containers/auth.json`;
|
|
|
f207507 |
on Windows and macOS, at `$HOME/.config/containers/auth.json`
|
|
|
3d4e4fd |
|
|
|
3d4e4fd |
## FORMAT
|
|
|
3d4e4fd |
|
|
|
3d4e4fd |
The auth.json file stores encrypted authentication information for the
|
|
|
3d4e4fd |
user to container image registries. The file can have zero to many entries and
|
|
|
f207507 |
is created by a `login` command from a container tool such as `podman login`,
|
|
|
f207507 |
`buildah login` or `skopeo login`. Each entry includes the name of the registry and then an auth
|
|
|
3d4e4fd |
token in the form of a base64 encoded string from the concatenation of the
|
|
|
3d4e4fd |
username, a colon, and the password.
|
|
|
3d4e4fd |
|
|
|
3d4e4fd |
The following example shows the values found in auth.json after the user logged in to
|
|
|
3d4e4fd |
their accounts on quay.io and docker.io:
|
|
|
3d4e4fd |
|
|
|
3d4e4fd |
```
|
|
|
3d4e4fd |
{
|
|
|
3d4e4fd |
"auths": {
|
|
|
3d4e4fd |
"docker.io": {
|
|
|
3d4e4fd |
"auth": "erfi7sYi89234xJUqaqxgmzcnQ2rRFWM5aJX0EC="
|
|
|
3d4e4fd |
},
|
|
|
3d4e4fd |
"quay.io": {
|
|
|
3d4e4fd |
"auth": "juQAqGmz5eR1ipzx8Evn6KGdw8fEa1w5MWczmgY="
|
|
|
3d4e4fd |
}
|
|
|
3d4e4fd |
}
|
|
|
3d4e4fd |
}
|
|
|
3d4e4fd |
```
|
|
|
3d4e4fd |
|
|
|
3d4e4fd |
An entry can be removed by using a `logout` command from a container
|
|
|
3d4e4fd |
tool such as `podman logout` or `buildah logout`.
|
|
|
3d4e4fd |
|
|
|
f207507 |
In addition, credential helpers can be configured for specific registries and the credentials-helper
|
|
|
f207507 |
software can be used to manage the credentials in a more secure way than depending on the base64 encoded authentication
|
|
|
f207507 |
provided by `login`. If the credential helpers are configured for specific registries, the base64 encoded authentication will not be used
|
|
|
f207507 |
for operations concerning credentials of the specified registries.
|
|
|
f207507 |
|
|
|
f207507 |
When the credential helper is in use on a Linux platform, the auth.json file would contain keys that specify the registry domain, and values that specify the suffix of the program to use (i.e. everything after docker-credential-). For example:
|
|
|
f207507 |
|
|
|
f207507 |
```
|
|
|
f207507 |
{
|
|
|
f207507 |
"auths": {
|
|
|
f207507 |
"localhost:5001": {}
|
|
|
f207507 |
},
|
|
|
f207507 |
"credHelpers": {
|
|
|
f207507 |
"registry.example.com": "secretservice"
|
|
|
f207507 |
}
|
|
|
f207507 |
}
|
|
|
f207507 |
```
|
|
|
f207507 |
|
|
|
f207507 |
For more information on credential helpers, please reference the [GitHub docker-credential-helpers project](https://github.com/docker/docker-credential-helpers/releases).
|
|
|
f207507 |
|
|
|
3d4e4fd |
# SEE ALSO
|
|
|
f207507 |
buildah-login(1), buildah-logout(1), podman-login(1), podman-logout(1), skopeo-login(1), skopeo-logout(1)
|
|
|
3d4e4fd |
|
|
|
3d4e4fd |
# HISTORY
|
|
|
3d4e4fd |
Feb 2020, Originally compiled by Tom Sweeney <tsweeney@redhat.com>
|