Tart with docker credentials helpers for ECR

[jaylyerly]

I'm trying to use a docker credential helper for ECR to manage logins to an ECR registry. I think I have everything set up but it failed with a this error when I do a pull.

% env AWS_PROFILE=tart tart pull  4XXXXXXXXX.dkr.ecr.us-east-1.amazonaws.com/tart:latest  
Error: UnexpectedHTTPStatusCode(when: "pulling manifest", code: 403, details: "{\"errors\":[{\"code\":\"DENIED\",\"message\":\"Your authorization token has expired. Reauthenticate and try again.\"}]}\n")

Manually, I can do the following for a pull:

aws ecr get-login-password --region us-east-1 --profile tart | tart login 4XXXXXXXXX.dkr.ecr.us-east-1.amazonaws.com --username AWS --password-stdin

tart pull 4XXXXXXXXX.dkr.ecr.us-east-1.amazonaws.com/tart:latest

I installed docker-credential-helper-ecr via brew and I have my credentials set up in ~/.aws/credentials. My ~/.docker/config.json looks like this:

{
    "credsStore": "ecr-login"
}

I feel like I'm missing a step here somewhere, but I'm not sure where. When I run the tart pull, nothing is logged in the ~/.ecr directory which makes me think that maybe the helper isn't getting invoked at all? Since I can manually log in use aws, I believe that my credentials are correct and have the proper access to ECR. Any pointers on how to debug this further?

[fkorotkov]

I initially though that Tart is not passing environment variables properly but @edigaryev noted in #490 that you use credsStore and Tart only supports credsHelpers (a newer thing). You need to use it instead in your ~/.docker/config.json:

{
	"credHelpers": {
		"4XXXXXXXXX.dkr.ecr.us-east-1.amazonaws.com": "ecr-login"
	}
}

[jaylyerly]

Ah, I believe that's the missing piece! After making that change, it seems to be be running smoothly now. Thanks!