Question: I am running a `docker login` command as a part of the Bamboo build job. The command text is obtained by `aws ecr get-login` call and executed in a subshell.

This command fails with `Error saving credentials: error storing credentials - err: exit status 1, out: write permissions error` when ran as a part of the Bamboo build, but the exact same command ran in the Terminal on the Mac that is the build agent, it succeeds.

Using Terminal:

* `aws ecr get-login` succeeds and returns the `docker login` command text
* `docker login -u ... -p ... -e none ...` succeeds and logs in
* There is a record for the ECR URL in KeyChain
* There is an entry in `~/.docker/config.json`

Using Bamboo:

* `aws ecr get-login` succeeds and returns the `docker login` command text
* `docker login -u ... -p ... -e none ...` fails with the error above
* KeyChain record being made available to all applications makes no difference'
* `chmod 777 ~/.docker/config.json` makes no difference

Both the Bamboo build and the Terminal session happen under the same user - `builduser`. `whoami` is the same for both. `stat ~/.docker/config.json` is the same for both - writable for both.

Can you think of further ways of discovering the differences between the context Bamboo runs the build in and I do in the terminal? The error above, verbatim, related to `docker login` is nowhere to be found online.

Answer: 
I found this question while trying to use ECR to get a Docker container **running** within a Jenkins pipeline on an AWS EC2 instance with an IAM Instance Profile. I found lots of information about creating, pushing, and pulling instances from ECR, but not running. 

The goal is a Docker container with the specific Ruby and Ansible versions installed, with all the various dependencies like Gem files.

I found the following Jenkinsfile worked:

```
pipeline {
    agent any
    environment { 
        DOCKER_CONFIG = "${WORKSPACE}/docker.config"
    }
    stages {
        stage('Build') {
            steps {
                sh("rm -rf ${DOCKER_CONFIG}")
                sh("eval \$(aws ecr get-login --no-include-email | sed 's|https://||')")
                withDockerContainer(args: '-v ${WORKSPACE}:/scripts -v ${HOME}/.aws:/root/.aws', image: 'image_name:latest') {
                    sh("ruby script.rb")
                }
            }
        }
    }
}

```

Notes:

* The Docker login command alters the .docker/config.json file, and it appears to fail in some cases with a write error. My guess is that it cannot handle some combination of existing configuration in the file and errors out. Using the DOCKER\_CONFIG environment variable makes it create a new config file locally.
* Removing the ${DOCKER\_CONFIG} directory may not be necessary, and could possibly take some extra time. However, I think it might avoid the case where the credentials stored there are stale.
* This must be installed: <https://github.com/awslabs/amazon-ecr-credential-helper>
* I found the eval statement solution here: [Jenkins Amazon ECR: no basic auth credentials](https://stackoverflow.com/questions/43733396/jenkins-amazon-ecr-no-basic-auth-credentials)
If you have installed Docker Desktop, you should sign-in inside the desktop app. In the title bar, click on the sign-in button and follow de instructions to initialize your credentials store. You don't need to `docker login` from terminal.