[GitHub] marcoabreu closed pull request #13408: Change docker login

[GitBox <gi...@apache.org>]

marcoabreu closed pull request #13408: Change docker login
URL: https://github.com/apache/incubator-mxnet/pull/13408
 
 
   

This is a PR merged from a forked repository.
As GitHub hides the original diff on merge, it is displayed below for
the sake of provenance:

As this is a foreign pull request (from a fork), the diff is supplied
below (as it won't show otherwise due to GitHub magic):

diff --git a/ci/docker_cache.py b/ci/docker_cache.py
index 80fd8834ae3..fe1882a567a 100755
--- a/ci/docker_cache.py
+++ b/ci/docker_cache.py
@@ -30,10 +30,12 @@
 import sys
 import subprocess
 import json
+import time
 from typing import *
 import build as build_util
 
-
+DOCKERHUB_LOGIN_NUM_RETRIES = 5
+DOCKERHUB_RETRY_SECONDS = 5
 
 def build_save_containers(platforms, registry, load_cache) -> int:
     """
@@ -99,7 +101,6 @@ def _upload_image(registry, docker_tag, image_id) -> None:
     :param image_id: Image id
     :return: None
     """
-    _login_dockerhub()
     # We don't have to retag the image since it is already in the right format
     logging.info('Uploading %s (%s) to %s', docker_tag, image_id, registry)
     push_cmd = ['docker', 'push', docker_tag]
@@ -112,9 +113,40 @@ def _login_dockerhub():
     :return: None
     """
     dockerhub_credentials = _get_dockerhub_credentials()
-    login_cmd = ['docker', 'login', '--username', dockerhub_credentials['username'], '--password',
-                 dockerhub_credentials['password']]
-    subprocess.check_call(login_cmd)
+
+    for i in range(DOCKERHUB_LOGIN_NUM_RETRIES):
+        logging.info('Logging in to DockerHub')
+        # We use password-stdin instead of --password to avoid leaking passwords in case of an error.
+        # This method will produce the following output:
+        # > WARNING! Your password will be stored unencrypted in /home/jenkins_slave/.docker/config.json.
+        # > Configure a credential helper to remove this warning. See
+        # > https://docs.docker.com/engine/reference/commandline/login/#credentials-store
+        # Since we consider the restricted slaves a secure environment, that's fine. Also, using this will require
+        # third party applications which would need a review first as well.
+        p = subprocess.run(['docker', 'login', '--username', dockerhub_credentials['username'], '--password-stdin'],
+                           stdout=subprocess.PIPE, input=str.encode(dockerhub_credentials['password']))
+        logging.info(p.stdout)
+        if p.returncode != 0:
+            logging.error('Error logging in to DockerHub')
+            logging.error(p.stderr)
+
+            # Linear backoff
+            time.sleep(1000 * DOCKERHUB_RETRY_SECONDS * (i + 1))
+        else:
+            logging.info('Successfully logged in to DockerHub')
+            break
+    else:
+        logging.error('DockerHub login not possible after %d retries, aborting', DOCKERHUB_LOGIN_NUM_RETRIES)
+        raise Exception('Unable to log in to DockerHub')
+
+def _logout_dockerhub():
+    """
+    Log out of DockerHub to delete local credentials
+    :return: None
+    """
+    logging.info('Logging out of DockerHub')
+    subprocess.call(['docker', 'logout'])
+    logging.info('Successfully logged out of DockerHub')
 
 
 def load_docker_cache(registry, docker_tag) -> None:
@@ -217,7 +249,11 @@ def script_name() -> str:
     args = parser.parse_args()
 
     platforms = build_util.get_platforms()
-    return build_save_containers(platforms=platforms, registry=args.docker_registry, load_cache=True)
+    try:
+        _login_dockerhub()
+        return build_save_containers(platforms=platforms, registry=args.docker_registry, load_cache=True)
+    finally:
+        _logout_dockerhub()
 
 
 if __name__ == '__main__':


 

----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on GitHub and use the
URL above to go to the specific comment.
 
For queries about this service, please contact Infrastructure at:
users@infra.apache.org


With regards,
Apache Git Services