act
act copied to clipboard
nektos
m1: act fails to pull with unauthorized: incorrect username or password
Discussed in https://github.com/nektos/act/discussions/1165
Originally posted by ssbarnea May 15, 2022 I am on MacOS M1 and act failed to even pull the container reporting not being able to login to docker registry, but docker works correctly and it is able to pull.
$ act
WARN ⚠ You are using Apple M1 chip and you have not specified container architecture, you might encounter issues while running act. If so, try running it with '--container-architecture linux/amd64'. ⚠
ERRO[0000] Unable to interpolate expression 'format('{0}', matrix.env.TOXENV)': Unable to dereference 'toxenv' on non-struct 'invalid'
ERRO[0000] 'runs-on' key not defined in push/ack
ERRO[0000] 'runs-on' key not defined in push/ack
[tox/lint-1 ] 🧪 Matrix: map[env:map[TOXENV:lint] os:ubuntu-20.04 python-version:3.9]
[tox/py-3 ] 🧪 Matrix: map[env:map[TOXENV:py] os:ubuntu-20.04 python-version:3.9]
[tox/packaging-2] 🧪 Matrix: map[env:map[TOXENV:packaging] os:ubuntu-20.04 python-version:3.9]
[tox/py-3 ] 🚀 Start image=node:16-buster-slim
[tox/packaging-2] 🚀 Start image=node:16-buster-slim
[tox/lint-1 ] 🚀 Start image=node:16-buster-slim
[tox/py-3 ] 🐳 docker pull image=node:16-buster-slim platform= username= forcePull=false
[tox/packaging-2] 🐳 docker pull image=node:16-buster-slim platform= username= forcePull=false
[tox/lint-1 ] 🐳 docker pull image=node:16-buster-slim platform= username= forcePull=false
Error: Error response from daemon: Head "https://registry-1.docker.io/v2/library/node/manifests/16-buster-slim": unauthorized: incorrect username or password
FAIL: 1
ssbarnea@m1: ~/c/schemastorepy main
$ docker pull node:16-buster-slim
16-buster-slim: Pulling from library/node
383d573fdcf2: Pull complete
a3942ef45b19: Pull complete
233507218b05: Pull complete
d14f918387bf: Pull complete
9f12e5ac2608: Pull complete
Digest: sha256:e5936cf8dbbb3c0d9d337c0e9f23e56e00b7e62280a8a617d12adfdda8ca9f11
Status: Downloaded newer image for node:16-buster-slim
docker.io/library/node:16-buster-slim
ssbarnea@m1: ~/c/schemastorepy main
$ docker --version
Docker version 20.10.14, build a224086
```</div>
I am not using an m1, but I hit a similar error (even earlier in the process):
act "pull_request" \
-s DOCKER_USERNAME \
-s DOCKER_PASSWORD
[pr/build] 🚀 Start image=catthehacker/ubuntu:act-latest
[pr/build] 🐳 docker pull image=catthehacker/ubuntu:act-latest platform= username=*** forcePull=false
Error: Error response from daemon: Head "https://registry-1.docker.io/v2/catthehacker/ubuntu/manifests/act-latest": unauthorized: incorrect username or password
make: *** [test] Error 1
I briefly checked my rate-limit:
curl --head -H "Authorization: Bearer $TOKEN" https://registry-1.docker.io/v2/ratelimitpreview/test/manifests/latest 2>&1
HTTP/1.1 200 OK
content-length: 2782
content-type: application/vnd.docker.distribution.manifest.v1+prettyjws
docker-content-digest: sha256:767a3815c34823b355bed31760d5fa3daca0aec2ce15b217c9cd83229e0e2020
docker-distribution-api-version: registry/2.0
etag: "sha256:767a3815c34823b355bed31760d5fa3daca0aec2ce15b217c9cd83229e0e2020"
date: Sat, 21 May 2022 13:31:38 GMT
strict-transport-security: max-age=31536000
ratelimit-limit: 100;w=21600
ratelimit-remaining: 99;w=21600
docker-ratelimit-source: redacted
I can manually pull the image too:
❯ docker pull catthehacker/ubuntu:act-latest
act-latest: Pulling from catthehacker/ubuntu
d5fd17ec1767: Pull complete
b802a9f71706: Pull complete
da477514e5fd: Pull complete
03f807692b16: Pull complete
3940e38805ed: Pull complete
4f4fb700ef54: Pull complete
9b1c548cba3d: Pull complete
4d0715de63c4: Pull complete
Digest: sha256:93a6c9bb4e14a04c1b9f0faaf8f6ca7b3a30d268937f470aa45800b84b315820
Status: Downloaded newer image for catthehacker/ubuntu:act-latest
docker.io/catthehacker/ubuntu:act-latest
Once I pulled the image myself, act continues to work.
I just double-checked, I am also not "logged" into docker.com or something (via ~/docker/config.json).
act "pull_request" \ -s DOCKER_USERNAME \ -s DOCKER_PASSWORD
Are you sure you don't input any whitespace or typo when asked for credentials?
Are you sure you don't input any whitespace or typo when asked for credentials?
I didn't even get that far. See my "log excerpt".
I didn't even get that far. See my "log excerpt".
It should ask before running act at all
~/void-pkgs (act)> act -s DOCKER_USERNAME
Provide value for 'DOCKER_USERNAME':
The variables are in my environment.
They are used for secrets in a run. Are you saying these are used for "automatic" login to Docker Hub by act?
And isn't it kinda odd to use the same API to configure the workflow (-s) for the tool?
+1 on Ubuntu 22.04 on WSL2 using Docker Desktop 4.12.0 (85629), when trying to pull node:16-buster-slim with act. Works fine with docker pull node:16-buster-slim.
Unsuccessfully tried to pass secrets with:
- The
--secret-fileflag - The
--env-fileflag - Hardcoding the values in the
.ymlfile
The only way it worked was by directly passing the values with the -s flag:
act -s DOCKER_USERNAME=user -s DOCKER_PASSWORD=password
More information about my system is below:
Output of lsb_release -a command:
Distributor ID: Ubuntu
Description: Ubuntu 22.04.1 LTS
Release: 22.04
Codename: jammy
The output of the uname command:
Kernel name: Linux
Kernel release: 5.15.57.1-microsoft-standard-WSL2
Kernel version: #1 SMP Wed Jul 27 02:20:31 UTC 2022
Machine: x86_64
Processor: x86_64
Hardware platform: x86_64
OS: GNU/Linux
The output of the docker version command:
Client: Docker Engine - Community
Cloud integration: v1.0.29
Version: 20.10.17
API version: 1.41
Go version: go1.17.11
Git commit: 100c701
Built: Mon Jun 6 23:03:17 2022
OS/Arch: linux/amd64
Context: default
Experimental: true
Server: Docker Desktop
Engine:
Version: 20.10.17
API version: 1.41 (minimum version 1.12)
Go version: go1.17.11
Git commit: a89b842
Built: Mon Jun 6 23:01:23 2022
OS/Arch: linux/amd64
Experimental: false
containerd:
Version: 1.6.8
GitCommit: 9cd3357b7fd7218e4aec3eae239db1f68a5a6ec6
runc:
Version: 1.1.4
GitCommit: v1.1.4-0-g5fd4c4d
docker-init:
Version: 0.19.0
GitCommit: de40ad0
I'm also having this issue on windows. Is it a requirement to pass the username and password each run? Seems like it should just use the docker login I've already completed...
I'm also having this issue on windows. Is it a requirement to pass the username and password each run? Seems like it should just use the docker login I've already completed...
Hi @damccull, hope you're doing well
Try this command:
export DOCKER_HOST=$(docker context inspect --format '{{.Endpoints.docker.Host}}') && act
I'll give it a shot. I did solve it by manually pulling the image and setting --pull=false in the .actrc though.
I would guess that the password act reads out of docker login in docker desktop is a placeholder instead of the actual password (which is stored in a credentials store) Act versions starting with v0.2.46 (1 June 2023 / https://github.com/nektos/act/pull/1774) should automatically try to pull without credentials, before failing to pull.
Why can't act just issue the "docker pull" command and delegate the responsibility to the already authenticated docker?
OS Name Microsoft Windows 11 Enterprise Version 10.0.22631 Build 22631 System Type x64-based PC Installed Physical Memory (RAM) 32.0 GB
Docker Desktop installed
PS C:\private\private-job-application-app> act -j build-and-deploy
time="2023-12-15T12:26:52+01:00" level=warning msg="Could not find any stages to run. View the valid jobs with `act --list`. Use `act --help` to find how to filter by Job ID/Workflow/Event Name"
time="2023-12-15T12:26:52+01:00" level=warning msg="Could not find any stages to run. View the valid jobs with `act --list`. Use `act --help` to find how to filter by Job ID/Workflow/Event Name"
time="2023-12-15T12:26:52+01:00" level=warning msg="Could not find any stages to run. View the valid jobs with `act --list`. Use `act --help` to find how to filter by Job ID/Workflow/Event Name"
time="2023-12-15T12:26:52+01:00" level=warning msg="Could not find any stages to run. View the valid jobs with `act --list`. Use `act --help` to find how to filter by Job ID/Workflow/Event Name"
[Run Azure Login with OIDC/build-and-deploy] 🚀 Start image=catthehacker/ubuntu:full-latest
time="2023-12-15T12:26:52+01:00" level=info msg="Parallel tasks (0) below minimum, setting to 1"
[Run Azure Login with OIDC/build-and-deploy] 🐳 docker pull image=catthehacker/ubuntu:full-latest platform= username= forcePull=true
[Run Azure Login with OIDC/build-and-deploy] using DockerAuthConfig authentication for docker pull
[Run Azure Login with OIDC/build-and-deploy] pulling image 'docker.io/catthehacker/ubuntu:full-latest' () failed with credentials Error response from daemon: Head "https://registry-1.docker.io/v2/catthehacker/ubuntu/manifests/full-latest": unauthorized: incorrect username or password retrying without them, please check for stale docker config files
time="2023-12-15T12:26:54+01:00" level=info msg="Parallel tasks (0) below minimum, setting to 1"
[Run Azure Login with OIDC/build-and-deploy] 🐳 docker create image=catthehacker/ubuntu:full-latest platform= entrypoint=["tail" "-f" "/dev/null"] cmd=[] network="host"
[Run Azure Login with OIDC/build-and-deploy] 🐳 docker run image=catthehacker/ubuntu:full-latest platform= entrypoint=["tail" "-f" "/dev/null"] cmd=[] network="host"
Error: failed to start container: Error response from daemon: network-scoped alias is supported only for containers in user defined networks
PS C:\private\private-job-application-app>
@sukkergris This is not your only problem,
This is your more relevant problem due to beeing on windows:
Error: failed to start container: Error response from daemon: network-scoped alias is supported only for containers in user defined networks
See here https://github.com/nektos/act/issues/2074
So, A fix for this (at least for me), on MacOS devices, if you look at your ~/.docker/config.json, I had "credsStore": "desktop" set. Changing this to "credsStore": "osxkeychain" allowed docker pulls to complete successfully!
