Login credentials are case-senstive

[hswimelar]

Description

For images which require authorization, the host passed to the docker login command must match the host in the image in a case-sensitive manner. Reported to us at GitLab originally here: https://gitlab.com/gitlab-org/gitlab/-/issues/255291

Steps to reproduce the issue:
Assuming a registry running and reachable at test.registry.org

1. docker build -t Test.Registry.org/test:latest .
2. docker login test.registry.org
3. docker push Test.Registry.org/test:latest auth fails

Describe the results you received:

Authentication fails.

Describe the results you expected:

Authentication does not fail.

Additional information you deem important (e.g. issue happens only occasionally):

The client is caching the login credentials in a case-sensitive manner

09:04 $ cat ~/.docker/config.json
{
        "auths": {
                "Test.Registry.org": {
                        "auth": "super-secret"
                },
                "test.registry.org": {
                        "auth": "super-secret"
                }
        },
        "HttpHeaders": {
                "User-Agent": "Docker-Client/19.03.13 (linux)"
        },
        "experimental": "enabled"
}

Output of docker version:

09:56 $ docker version
Client: Docker Engine - Community
 Version:           19.03.13
 API version:       1.40
 Go version:        go1.13.15
 Git commit:        4484c46d9d
 Built:             Wed Sep 16 17:02:36 2020
 OS/Arch:           linux/amd64
 Experimental:      true

Server: Docker Engine - Community
 Engine:
  Version:          19.03.13
  API version:      1.40 (minimum version 1.12)
  Go version:       go1.13.15
  Git commit:       4484c46d9d
  Built:            Wed Sep 16 17:01:06 2020
  OS/Arch:          linux/amd64
  Experimental:     false
 containerd:
  Version:          1.3.7
  GitCommit:        8fba4e9a7d01810a393d5d25a3621dc101981175
 runc:
  Version:          1.0.0-rc10
  GitCommit:        dc9208a3303feef5b3839f4323d9beb36df0a9dd
 docker-init:
  Version:          0.18.0

Output of docker info:

Client:
 Debug Mode: false
 Plugins:
  app: Docker Application (Docker Inc., v0.8.0)
  buildx: Build with BuildKit (Docker Inc., v0.4.2-tp-docker)

Server:
 Containers: 6
  Running: 0
  Paused: 0
  Stopped: 6
 Images: 71
 Server Version: 19.03.13
 Storage Driver: overlay2
  Backing Filesystem: extfs
  Supports d_type: true
  Native Overlay Diff: true
 Logging Driver: json-file
 Cgroup Driver: cgroupfs
 Plugins:
  Volume: local
  Network: bridge host ipvlan macvlan null overlay
  Log: awslogs fluentd gcplogs gelf journald json-file local logentries splunk syslog
 Swarm: inactive
 Runtimes: runc
 Default Runtime: runc
 Init Binary: docker-init
 containerd version: 8fba4e9a7d01810a393d5d25a3621dc101981175
 runc version: dc9208a3303feef5b3839f4323d9beb36df0a9dd
 init version: fec3683
 Security Options:
  apparmor
  seccomp
   Profile: default
 Kernel Version: 5.4.0-48-generic
 Operating System: Ubuntu 18.04.5 LTS
 OSType: linux
 Architecture: x86_64
 CPUs: 16
 Total Memory: 30.99GiB
 Name: hayley-Precision-5540
 ID: CI4P:CT65:VU5N:4VFX:BHYO:ABRF:HDYL:EXN7:KFDA:QHO6:OY6V:WV7U
 Docker Root Dir: /var/lib/docker
 Debug Mode: false
 Registry: https://index.docker.io/v1/
 Labels:
 Experimental: false
 Insecure Registries:
  gitlab.local:5000
  127.0.0.0/8
 Live Restore Enabled: false

WARNING: No swap limit support

Additional environment details (AWS, VirtualBox, physical, etc.):

10:00 $ uname -a
Linux hayley-Precision-5540 5.4.0-48-generic #52~18.04.1-Ubuntu SMP Thu Sep 10 12:50:22 UTC 2020 x86_64 x86_64 x86_64 GNU/Linux

[thaJeztah]

Thanks for reporting! Yes, I think we should improve this handling.

When implementing, we need to tread carefully in this area somewhat, as the credentials should be stored case-insensitive, but there's also the image tags that are using case-sensitivity (need to check the spec on what it describes there)

for example;

docker tag busybox Test.Registry.org/test:latest
docker tag busybox test.registry.org/test:latest

docker image ls --filter 'reference=*.org/*'
REPOSITORY               TAG                 IMAGE ID            CREATED             SIZE
Test.Registry.org/test   latest              018c9d7b792b        2 months ago        1.22MB
test.registry.org/test   latest              018c9d7b792b        2 months ago        1.22MB

[piotrowski]

Hi @thaJeztah Here is a PR: #2782

However I did find smth strange (I am not sure if it is a bug or not):

1. Push LOCALhost:5000/exampleImage
2. login to localhost:5000
3. Pull localhost:5000/exampleImage
4. Image was pulled

I tested it on normal (without my fix) version and it was working like this too, I did not push localhost:5000/exampleImage to the repository