Repository navigation
fix(server): use registry credentials for Docker source pulls - #5784
devcustrom wants to merge 1 commit into
Conversation
Docker-source applications that reference an image from a configured registry but have no app-level credentials currently pass no authconfig to the Swarm service. Workers then pull without credentials and can silently start an older local image with the same tag. Fall back to the configured registry credentials when the image explicitly targets that registry. Images from other registries and bare Docker Hub image names are left untouched, so private credentials are never sent to the wrong registry. Refs Dokploy#5469
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
| const fallbackRegistry = registry ?? buildRegistry; | ||
| if ( | ||
| !username && | ||
| !password && | ||
| fallbackRegistry && | ||
| isImageFromRegistry(dockerImage, fallbackRegistry.registryUrl) | ||
| ) { | ||
| const r = await findRegistryByIdWithCredentials( | ||
| fallbackRegistry.registryId, | ||
| ); |
There was a problem hiding this comment.
If the deployment server has no saved Docker login, this fallback runs too late. deployApplication calls buildRemoteDocker before getAuthConfig, and that earlier pull only logs in with app-level credentials. An app relying on the configured registry therefore fails before reaching this fallback.
Reuse the same matched registry credentials before the initial docker pull.
| const registryHost = getRegistryHost(registryUrl); | ||
| if (!image || !registryHost) return false; |
There was a problem hiding this comment.
registryUrl defaults to "", which the registry schema explicitly supports as Docker Hub. The new matcher turns that value into null and returns false, even for docker.io/team/private:latest. The fallback then supplies no credentials to Swarm workers, so private image pulls still fail.
Treat an empty configured registry URL as Docker Hub while keeping a missing registry separate, and add a fallback test for this case.
Problem
For Docker-source applications (
sourceType: "docker"),getAuthConfig()only returns credentials from the application itself. When the image comes from a globally configured registry (application.registry) but the app-level Docker credentials are empty, Dokploy passes noauthconfigtoservice.update()/createService().Swarm workers then try to pull anonymously:
If a local image with the same tag already exists, Docker starts the stale image and the deployment still reports success.
Fix
When a Docker-source app has no credentials of its own, reuse the configured registry's credentials if the image reference explicitly targets that registry. Bare image names (which resolve to Docker Hub) and images from other registries are excluded, so private registry credentials are never sent to the wrong registry.
Tests
apps/dokploy/__test__/registry/registry-host.test.ts— registry/image host parsing and matching.apps/dokploy/__test__/registry/docker-source-auth-config.test.ts— fallback behavior and existing paths.Related
AuthConfig.serveraddressand reports registry/image mismatches. This PR complements it and does not change the image reference.Fix the initial private pull and default Docker Hub matching before merging.
Summary
Adds saved registry credentials as a fallback for Docker-source apps with no app-level credentials.
Reviews (1) · Last reviewed commit: "fix(server): use registry credentials fo..." · Reviewed by Greptile