Maven jib:dockerBuild fails for non-root user on Ubuntu (and in Windows wsl2 as well)

Question

Update: I removed Docker entirely by following this link: https://askubuntu.com/a/1021506

I then reinstalled Docker like this: https://docs.docker.com/engine/install/ubuntu/

Right after the reinstall, mvn jib:dockerBuild worked without sudo.

When running gcloud auth configure-docker , this was added to.docker/config.json

       "credHelpers": {
                "asia.gcr.io": "gcloud",
                "eu.gcr.io": "gcloud",
                "gcr.io": "gcloud",
                "marketplace.gcr.io": "gcloud",
                "staging-k8s.gcr.io": "gcloud",
                "us.gcr.io": "gcloud"
        }

and problem reappears. Removing the above section manually in config.json made mvn jib:dockerBuild work again.

---

Running the following command

mvn jib:dockerBuild

with a plain Micronaut 3.0.2 project gives this output:

[ERROR] Failed to execute goal com.google.cloud.tools:jib-maven-plugin:2.7.1:dockerBuild (default-cli) on project barn-validation-step: Build to Docker daemon failed, perhaps you should make sure your credentials for 'registry-1.docker.io/library/openjdk' are set up correctly. See https://github.com/GoogleContainerTools/jib/blob/master/docs/faq.md#what-should-i-do-when-the-registry-responds-with-unauthorized for help: Unauthorized for registry-1.docker.io/library/openjdk: 401 Unauthorized
[ERROR] GET https://auth.docker.io/token?service=registry.docker.io&scope=repository:library/openjdk:pull
[ERROR] {"details":"incorrect username or password"}

When using the same command with sudo:

sudo env "PATH=$PATH" mvn jib:dockerBuild

build is successful. Build is also successful when using Maven step in Azure Pipelines.

I've read the content from the URL in the error message. I've also spent a couple of hours searching for solutions elsewhere, no luck so far.

I'm able to login using docker login , and

curl https://auth.docker.io/token?service=registry.docker.io&scope=repository:library/openjdk:pull

returns a token

Answer 1

If you provide wrong username or password, Docker Hub returns the following error message:

$ docker login -u foo -p bar
WARNING! Using --password via the CLI is insecure. Use --password-stdin.
Error response from daemon: Get https://registry-1.docker.io/v2/: unauthorized: incorrect username or password

Note the same message you see when running Jib. The message is from Docker Hub:

[ERROR] {"details":"incorrect username or password"}

Also from the fact that sudo env "PATH=$PATH" mvn jib:dockerBuild worked, it must be that Jib running in your local user environment uses different username and password information.

Jib searches various locations to retrieve registry credentials (which is simply a username and password pair), so it must be that the credentials that Jib picks up when running as root and when running as your user are different. As explained in the doc, Jib log will reveal where it picked up credentials. For example,

Using credentials from Docker config (/home/user/.docker/config.json) for localhost:5000/java

or

Using credential helper docker-credential-gcr for gcr.io/project/repo

Check the log to identify where the credentials are coming from and fix them.

Answer 2

This command caused the trouble:

gcloud auth configure-docker`

By using

gcloud auth configure-docker eu.gcr.io 

instead, everything works as depicted. The reason seems to be that with the latter command, there is no collision between Jib base image repository and my target repository (which is located inside eu.gcr.io).