Answers: <p>I was able to produce a correct behaviour starting from <code>centos:centos7</code> base image and installing Docker only (no Jenkins yet) via the steps provided in the official Docker docu:
  <a href="https://docs.docker.com/engine/install/centos/" rel="nofollow noreferrer">https://docs.docker.com/engine/install/centos/</a></p>
  <p>Seen here:</p>
  <pre><code>[root@d8d441ae6a7a /]# history
      2  yum remove docker                   docker-client                   docker-client-latest                   docker-common                   docker-latest                   docker-latest-logrotate                   docker-logrotate                   docker-engine
      3  yum install -y yum-utils
      4  yum-config-manager     --add-repo     https://download.docker.com/linux/centos/docker-ce.repo
      5  yum install docker-ce docker-ce-cli containerd.io
      6  systemctl start docker
      7  docker ps
      8  docker run hello-world
      9  docker login https://nexus:port
  10  docker login https://nexus:port
  11  docker pull nexus:port/company/image:tag
  
  
  # docker pull nexus:port/company/image:tag
  ...
  Status: Downloaded newer image for nexus:port/company/image:tag
  </code></pre>
  <p>While I still have the faulty behaviour when I install docker via <code>yum install -y docker</code>. So it's pretty clear to assume that I'm not facing an issue with the Jenkins Docker images specifically but rather face centos problems with their Docker package.</p>
  <p>I guess there is no need here for an answer. I will go on to talk to the centos people.</p>
  <p>Cheers and thanks for your consideration everyone!</p>
  
Answers: CC BY-SA 4.0
Answers: 2020-07-13T13:31:21.663Z
Answers: 2020-07-13T13:31:21.663Z
Answers: Worp
Answers: <p>Based on your output, all of your docker commands are running as root when in general they should be running as the jenkins user. You can try switching the user to jenkins and running the same docker login and pull commands.</p>
  <p>I've used the following in my Jenkins pipeline scripts to log into a Nexus 3 Docker repository (<a href="https://docs.cloudbees.com/docs/admin-resources/latest/plugins/docker-workflow" rel="nofollow noreferrer">https://docs.cloudbees.com/docs/admin-resources/latest/plugins/docker-workflow</a>):</p>
  <pre><code>docker.withRegistry('https://docker.mycorp.com/', 'docker-login') {
    git '…'
    docker.build('myapp').push('latest')
  }
  </code></pre>
  
Answers: CC BY-SA 4.0
Answers: 2020-07-10T07:08:56.627Z
Answers: Cheers and thanks for your answer m8! Sadly switching to the Jenkins user hasn't changed anything. The Jenkins user itself can't interact with Docker (cause he's not root and not in the 'docker' group per default). Even if you put him into the docker group so he can interact, he still can't pull.
Answers: Worp
Answers: CC BY-SA 4.0
Answers: 2020-07-13T13:32:56.817Z
Answers: Just wanted to say thanks again for your consideration. In this particular instance the problem seems to be within the docker yum package installed via `yum install -y docker`. Installing docker in the officially documented way works fine afterwards.
Answers: Worp
Answers: CC BY-SA 4.0
Answers: 2020-07-09T16:48:16.563Z
Answers: 2020-07-09T16:48:16.563Z
Answers: MSumulong
Answers: <p>The same problem occured for me after I have updated docker to the version 23.0.4 on a jenkins node.</p>
  <p>In my case the problem was that the jenkins node wasn't able to store passes properly using the old way without <a href="https://docs.docker.com/engine/reference/commandline/login/#credentials-store" rel="nofollow noreferrer">credentials store</a>, which is just storing passes as a base64 encoded string in <code>~/.docker/config.yaml</code>. Even though it was working fine before updating docker.</p>
  <p>The only solution that worked for me was configuring <a href="https://docs.docker.com/engine/reference/commandline/login/#credentials-store" rel="nofollow noreferrer">credentials store</a> on that Jenkins node and performing some additional workarounds.</p>
  <p>I have configured credentials store using following instruction:
  <a href="https://leimao.github.io/blog/Docker-Login-Encrypted-Credentials/" rel="nofollow noreferrer">https://leimao.github.io/blog/Docker-Login-Encrypted-Credentials/</a></p>
  <p>And the additional workarounds were:</p>
  <ol>
  <li>Exporting GPG_TTY env: <code>export GPG_TTY=$(tty)</code>. This has to be exported every time the jenkins user login to docker so I have added this line to <code>.bashrc</code> file of my jenkins user. Without this env the Ubuntu Keyring wasn't detecting that my jenkins user is trying to access the <code>gpg</code> key and login to docker was failing.</li>
  <li>Setting empty password for <code>gpg</code> key created when configuring Credentials Store. I had to make it empty because my Jenkins user wasn't able to pass a password for Ubuntu keyring as the keyring was using a popup to ask for the password.</li>
  </ol>
  
Answers: CC BY-SA 4.0
Answers: 2023-05-29T10:50:06.320Z
Answers: 2023-05-29T10:50:06.320Z
Answers: Kecz
Body: <p>I am setting up a new Jenkins as our old one is based on a deprecated base image.</p>
  <p>Dockerfile is:</p>
  <pre><code>FROM jenkins/jenkins:lts-centos7
  
  USER root
  
  RUN yum -y install docker \
      &amp;&amp; yum clean all
  
  USER jenkins
  </code></pre>
  <p>When I <code>docker exec ...</code> into the container and log into our Sonatype Nexus to pull Docker images from it, the successful login does not seem to be heeded by Jenkins afterwards:</p>
  <pre><code>[root@909fb3a3d52c .docker]# docker login https://our.nexus.internal:&lt;endpoint&gt;
  Username (jenkins): jenkins
  Password:
  Login Succeeded
  [root@909fb3a3d52c .docker]# pwd
  /root/.docker
  [root@909fb3a3d52c .docker]# cat config.json
  {
      &quot;auths&quot;: {
          &quot;https://our.nexus.internal:&lt;endpoint&gt;&quot;: {
              &quot;auth&quot;: &quot;&lt;CORRECT base64 hash&gt;&quot;
          }
      }
  </code></pre>
  <p>Login has succeeded, the auth credentials are written to /root/.docker/config.json and when I base64-decode them they are correct &quot;jenkins:&quot;.</p>
  <p>However:</p>
  <pre><code>[root@909fb3a3d52c .docker]# docker pull https://our.nexus.internal:&lt;endpoint&gt;/myImage:myTag
  Error response from daemon: Get https://our.nexus.internal:&lt;endpoint&gt;/v2/myImage/manifests/myTag: no basic auth credentials
  </code></pre>
  <p>This will also happen during execution of a Jenkins pipeline (obviously), where job log reports:</p>
  <pre><code>docker pull https://our.nexus.internal:&lt;endpoint&gt;/myImage:myTag
  
  Error response from daemon: Get Error response from daemon: Get https://our.nexus.internal:&lt;endpoint&gt;/v2/myImage/manifests/myTag: no basic auth credentials
  
  script returned exit code 1
  </code></pre>
  <p>I assume this to not be a question about nexus but about how the credentials from docker login are stored and used.</p>
  <p>Sidenote: We have a different Jenkins currently operational which is based on jenkinsci/blueocean:1.22.0 which does NOT display this behaviour. It can docker login fine and docker pull fine.</p>
  <p><strong>edit1:</strong></p>
  <p>Running <code>docker-compose</code> does work while a manual <code>docker pull...</code> will not:</p>
  <pre><code>[root@3eeee032ff08 /]# docker login https://nexus:port
  Username: jenkins
  Password:
  Login Succeeded
  
  [root@3eeee032ff08 /]# docker pull nexus:port/company/image:myTag
  Error response from daemon: Get https://nexus:port/v2/company/image/manifests/myTag: no basic auth credentials
  
  [root@3eeee032ff08 /]# cat docker-compose.yml
  version: '3.3'
  
  services:
  jenkins:
      user: root
      image: nexus:port/company/image:myTag
  
  [root@3eeee032ff08 /]# docker-compose up
  
  Creating network &quot;default_default&quot; with the default driver
  Pulling jenkins (nexus:port/company/image:myTag)...
  myTag: Pulling from company/image
  f34b00c7da20: Pull complete
  3f316190de62: Pull complete
  480967924aca: Pull complete
  619ac94672e0: Pull complete
  cb1c6713a236: Pull complete
  55766a17b1c6: Pull complete
  8f6e881b2ef2: Pull complete
  f118a721eee8: Pull complete
  fae3c8e02b83: Pull complete
  093ceb59408d: Pull complete
  e3bd3cbf474d: Pull complete
  41a6f4e5de6d: Pull complete
  aa1aece4c754: Pull complete
  fc897d8ca22f: Pull complete
  Digest: sha256:3fd74169f648784fe960add9c0138e3802a91e82c9b5fdbd734faaeaaef696f9
  Status: Downloaded newer image for nexus:port/company/image:myTag
  </code></pre>
  <p><strong>edit2:</strong></p>
  <p>When not basing off of <code>jenkins/jenkins:lts-centos7</code> but off of <code>jenkins/jenkins:latest</code>, which is a Debian base, then installing Docker on it using the <a href="https://docs.docker.com/engine/install/debian/" rel="nofollow noreferrer">official docs</a>, login and pulling works:</p>
  <pre><code>worp@local$ docker run --rm -ti -u root -v /var/run/docker.sock:/var/run/docker.sock jenkins/jenkins:debian-docker bash
  
  root@8aec8c792751:/# cat /etc/*-release
  PRETTY_NAME=&quot;Debian GNU/Linux 9 (stretch)&quot;
  NAME=&quot;Debian GNU/Linux&quot;
  VERSION_ID=&quot;9&quot;
  VERSION=&quot;9 (stretch)&quot;
  VERSION_CODENAME=stretch
  ID=debian
  HOME_URL=&quot;https://www.debian.org/&quot;
  SUPPORT_URL=&quot;https://www.debian.org/support&quot;
  BUG_REPORT_URL=&quot;https://bugs.debian.org/&quot;
  
  root@8aec8c792751:/# docker login https://nexus:port
  Username: admin
  Password:
  WARNING! Your password will be stored unencrypted in /root/.docker/config.json.
  Configure a credential helper to remove this warning. See
  https://docs.docker.com/engine/reference/commandline/login/#credentials-store
  
  Login Succeeded
  
  root@8aec8c792751:/# cat /root/.docker/config.json
  {
      &quot;auths&quot;: {
          &quot;nexus:port&quot;: {
              &quot;auth&quot;: &quot;&lt;base64hash&gt;&quot;
          }
      },
      &quot;HttpHeaders&quot;: {
          &quot;User-Agent&quot;: &quot;Docker-Client/19.03.12 (linux)&quot;
      }
  }
  
  root@8aec8c792751:/# docker pull nexus:port/company/image:myTag
  myTag: Pulling from company/image
  Digest: sha256:3fd74169f648784fe960add9c0138e3802a91e82c9b5fdbd734faaeaaef696f9
  Status: Image is up to date for nexus:port/company/image:myTag
  nexus:port/company/image:myTag
  </code></pre>
  <p>This is getting weirder by the minute. I hope I am overlooking something extremely obvious so I feel very stupid afterwards.</p>
  
Comments: CC BY-SA 4.0
Comments: 2020-07-09T16:44:14.297Z
Comments: It might help to post your Jenkinsfile or pipeline script where you use the company/image:myTag container.
Comments: MSumulong
Comments: CC BY-SA 4.0
Comments: 2020-07-10T07:07:25.180Z
Comments: @MSumulong it's actually any pipeline at all. Jenkins can't pull images as authentication won't work. Any pipelinie I pull up and run, as soon as it needs a Docker image (like with `docker.build()` or `docker.image()` they get "no basic auth credentials".
Comments: Worp
Tags: <docker><jenkins><docker-compose>
Title: Jenkins - docker login doesn't seem to persist: docker pull won't work but docker-compose can pull without problems
UserDisplayName: Worp
ThreadText: # Jenkins - docker login doesn't seem to persist: docker pull won't work but docker-compose can pull without problems
  
  (Asked by: username_0 on 2020-07-09)
  
  I am setting up a new Jenkins as our old one is based on a deprecated base image.
  
  Dockerfile is:
  
  ```
  FROM jenkins/jenkins:lts-centos7
  
  USER root
  
  RUN yum -y install docker \
      && yum clean all
  
  USER jenkins
  
  ```
  
  When I `docker exec ...` into the container and log into our Sonatype Nexus to pull Docker images from it, the successful login does not seem to be heeded by Jenkins afterwards:
  
  ```
  [root@909fb3a3d52c .docker]# docker login https://our.nexus.internal:<endpoint>
  Username (jenkins): jenkins
  Password:
  Login Succeeded
  [root@909fb3a3d52c .docker]# pwd
  /root/.docker
  [root@909fb3a3d52c .docker]# cat config.json
  {
      "auths": {
          "https://our.nexus.internal:<endpoint>": {
              "auth": "<CORRECT base64 hash>"
          }
      }
  
  ```
  
  Login has succeeded, the auth credentials are written to /root/.docker/config.json and when I base64-decode them they are correct "jenkins:".
  
  However:
  
  ```
  [root@909fb3a3d52c .docker]# docker pull https://our.nexus.internal:<endpoint>/myImage:myTag
  Error response from daemon: Get https://our.nexus.internal:<endpoint>/v2/myImage/manifests/myTag: no basic auth credentials
  
  ```
  
  This will also happen during execution of a Jenkins pipeline (obviously), where job log reports:
  
  ```
  docker pull https://our.nexus.internal:<endpoint>/myImage:myTag
  
  Error response from daemon: Get Error response from daemon: Get https://our.nexus.internal:<endpoint>/v2/myImage/manifests/myTag: no basic auth credentials
  
  script returned exit code 1
  
  ```
  
  I assume this to not be a question about nexus but about how the credentials from docker login are stored and used.
  
  Sidenote: We have a different Jenkins currently operational which is based on jenkinsci/blueocean:1.22.0 which does NOT display this behaviour. It can docker login fine and docker pull fine.
  
  **edit1:**
  
  Running `docker-compose` does work while a manual `docker pull...` will not:
  
  ```
  [root@3eeee032ff08 /]# docker login https://nexus:port
  Username: jenkins
  Password:
  Login Succeeded
  
  [root@3eeee032ff08 /]# docker pull nexus:port/company/image:myTag
  Error response from daemon: Get https://nexus:port/v2/company/image/manifests/myTag: no basic auth credentials
  
  [root@3eeee032ff08 /]# cat docker-compose.yml
  version: '3.3'
  
  services:
  jenkins:
      user: root
      image: nexus:port/company/image:myTag
  
  [root@3eeee032ff08 /]# docker-compose up
  
  Creating network "default_default" with the default driver
  Pulling jenkins (nexus:port/company/image:myTag)...
  myTag: Pulling from company/image
  f34b00c7da20: Pull complete
  3f316190de62: Pull complete
  480967924aca: Pull complete
  619ac94672e0: Pull complete
  cb1c6713a236: Pull complete
  55766a17b1c6: Pull complete
  8f6e881b2ef2: Pull complete
  f118a721eee8: Pull complete
  fae3c8e02b83: Pull complete
  093ceb59408d: Pull complete
  e3bd3cbf474d: Pull complete
  41a6f4e5de6d: Pull complete
  aa1aece4c754: Pull complete
  fc897d8ca22f: Pull complete
  Digest: sha256:3fd74169f648784fe960add9c0138e3802a91e82c9b5fdbd734faaeaaef696f9
  Status: Downloaded newer image for nexus:port/company/image:myTag
  
  ```
  
  **edit2:**
  
  When not basing off of `jenkins/jenkins:lts-centos7` but off of `jenkins/jenkins:latest`, which is a Debian base, then installing Docker on it using the [official docs](https://docs.docker.com/engine/install/debian/), login and pulling works:
  
  ```
  username_0@local$ docker run --rm -ti -u root -v /var/run/docker.sock:/var/run/docker.sock jenkins/jenkins:debian-docker bash
  
  root@8aec8c792751:/# cat /etc/*-release
  PRETTY_NAME="Debian GNU/Linux 9 (stretch)"
  NAME="Debian GNU/Linux"
  VERSION_ID="9"
  VERSION="9 (stretch)"
  VERSION_CODENAME=stretch
  ID=debian
  HOME_URL="https://www.debian.org/"
  SUPPORT_URL="https://www.debian.org/support"
  BUG_REPORT_URL="https://bugs.debian.org/"
  
  root@8aec8c792751:/# docker login https://nexus:port
  Username: admin
  Password:
  WARNING! Your password will be stored unencrypted in /root/.docker/config.json.
  Configure a credential helper to remove this warning. See
  https://docs.docker.com/engine/reference/commandline/login/#credentials-store
  
  Login Succeeded
  
  root@8aec8c792751:/# cat /root/.docker/config.json
  {
      "auths": {
          "nexus:port": {
              "auth": "<base64hash>"
          }
      },
      "HttpHeaders": {
          "User-Agent": "Docker-Client/19.03.12 (linux)"
      }
  }
  
  root@8aec8c792751:/# docker pull nexus:port/company/image:myTag
  myTag: Pulling from company/image
  Digest: sha256:3fd74169f648784fe960add9c0138e3802a91e82c9b5fdbd734faaeaaef696f9
  Status: Image is up to date for nexus:port/company/image:myTag
  nexus:port/company/image:myTag
  
  ```
  
  This is getting weirder by the minute. I hope I am overlooking something extremely obvious so I feel very stupid afterwards.
  
  **Tags:** docker, jenkins, docker-compose
  
  > **Comments:**
  > **username_1**: It might help to post your Jenkinsfile or pipeline script where you use the company/image:myTag container.  
  > **username_0**: @username_1 it's actually any pipeline at all. Jenkins can't pull images as authentication won't work. Any pipelinie I pull up and run, as soon as it needs a Docker image (like with `docker.build()` or `docker.image()` they get "no basic auth credentials".  
  
  ---
  
  ## 3 answers
  
  ### Answer by username_0 on 2020-07-13. Score: 1 | Accepted answer
  
  I was able to produce a correct behaviour starting from `centos:centos7` base image and installing Docker only (no Jenkins yet) via the steps provided in the official Docker docu:
  <https://docs.docker.com/engine/install/centos/>
  
  Seen here:
  
  ```
  [root@d8d441ae6a7a /]# history
      2  yum remove docker                   docker-client                   docker-client-latest                   docker-common                   docker-latest                   docker-latest-logrotate                   docker-logrotate                   docker-engine
      3  yum install -y yum-utils
      4  yum-config-manager     --add-repo     https://download.docker.com/linux/centos/docker-ce.repo
      5  yum install docker-ce docker-ce-cli containerd.io
      6  systemctl start docker
      7  docker ps
      8  docker run hello-world
      9  docker login https://nexus:port
  10  docker login https://nexus:port
  11  docker pull nexus:port/company/image:tag
  
  # docker pull nexus:port/company/image:tag
  ...
  Status: Downloaded newer image for nexus:port/company/image:tag
  
  ```
  
  While I still have the faulty behaviour when I install docker via `yum install -y docker`. So it's pretty clear to assume that I'm not facing an issue with the Jenkins Docker images specifically but rather face centos problems with their Docker package.
  
  I guess there is no need here for an answer. I will go on to talk to the centos people.
  
  Cheers and thanks for your consideration everyone!
  
  
  ---
  
  ### Answer by username_1 on 2020-07-09. Score: 1
  
  Based on your output, all of your docker commands are running as root when in general they should be running as the jenkins user. You can try switching the user to jenkins and running the same docker login and pull commands.
  
  I've used the following in my Jenkins pipeline scripts to log into a Nexus 3 Docker repository (<https://docs.cloudbees.com/docs/admin-resources/latest/plugins/docker-workflow>):
  
  ```
  docker.withRegistry('https://docker.mycorp.com/', 'docker-login') {
    git '…'
    docker.build('myapp').push('latest')
  }
  
  ```
  
  > **Comments:**
  > **username_0**: Cheers and thanks for your answer m8! Sadly switching to the Jenkins user hasn't changed anything. The Jenkins user itself can't interact with Docker (cause he's not root and not in the 'docker' group per default). Even if you put him into the docker group so he can interact, he still can't pull.  
  > **username_0**: Just wanted to say thanks again for your consideration. In this particular instance the problem seems to be within the docker yum package installed via `yum install -y docker`. Installing docker in the officially documented way works fine afterwards.  
  
  ---
  
  ### Answer by username_2 on 2023-05-29. Score: 0
  
  The same problem occured for me after I have updated docker to the version 23.0.4 on a jenkins node.
  
  In my case the problem was that the jenkins node wasn't able to store passes properly using the old way without [credentials store](https://docs.docker.com/engine/reference/commandline/login/#credentials-store), which is just storing passes as a base64 encoded string in `~/.docker/config.yaml`. Even though it was working fine before updating docker.
  
  The only solution that worked for me was configuring [credentials store](https://docs.docker.com/engine/reference/commandline/login/#credentials-store) on that Jenkins node and performing some additional workarounds.
  
  I have configured credentials store using following instruction:
  <https://leimao.github.io/blog/Docker-Login-Encrypted-Credentials/>
  
  And the additional workarounds were:
  
  1. Exporting GPG\_TTY env: `export GPG_TTY=$(tty)`. This has to be exported every time the jenkins user login to docker so I have added this line to `.bashrc` file of my jenkins user. Without this env the Ubuntu Keyring wasn't detecting that my jenkins user is trying to access the `gpg` key and login to docker was failing.
  2. Setting empty password for `gpg` key created when configuring Credentials Store. I had to make it empty because my Jenkins user wasn't able to pass a password for Ubuntu keyring as the keyring was using a popup to ask for the password.
  
  
  ---
  
  