ECR docker login fails due to insecure password option

Question

So I recently started to tryout Laravel vapor, while it was very quick and easy to get something running I wanted to try to implement one of my existing projects, which is roughly 500 MB. So I had to move over to use the docker container setup as it became too big for a simple lambda.

However, now when I try to run vapor deploy production I receive the following error:

The command "docker login --username AWS --password <super long string> xxx.dkr.ecr.eu-central-1.amazonaws.com" failed.       
                                                                                                                                                                                                                          
  Exit Code: 1(General error)                                                                                                                                                                                             
                                                                                                                                                                                                                          
  Working directory: /home/develop/projects/laravel-vapor/.vapor/build/app                                                                                                                                           
                                                                                                                                                                                                                          
  Output:                                                                                                                                                                                                                 
  ================                                                                                                                                                                                                        
                                                                                                                                                                                                                          
                                                                                                                                                                                                                          
  Error Output:                                                                                                                                                                                                           
  ================                                                                                                                                                                                                        
  WARNING! Using --password via the CLI is insecure. Use --password-stdin.                                                                                                                                                
  Error saving credentials: error storing credentials - err: exit status 1, out: `error storing credentials - err: exit status 1, out: pass not initialized: exit status 1: Error: password store is empty. Try "pass init".  

I haven't been able to find anything about this issue with laravel vapor and how to instruct vapor to use the --password-stdin command instead. Is there anything I can try to do this?

I am correctly logged in into the AWS CLI, but am still unable to actually get it to deploy to ECR.

Answer 1

This problem occurs because of a few thigs:

• vapor password is a long string
• vapor uses --password option to login to ECR;
• Docker for Windows uses a program win-credentials helper to store passwords;
• win-credentials doesn't allow long passwords

To make it work, I had to change vapor-cli code in other to login using --password-stdin docker's option.

at vapor-cli/src/Docker::publish

Process::fromShellCommandline(
    sprintf(
        "echo %s | docker login --username AWS --password-stdin %s",
        str_replace('AWS:', '', base64_decode($token)),
        explode('/', $repoUri)[0]
    ),
    $path
)->setTimeout(null)->mustRun();

I got this solution from: docker login: error storing credentials `The stub received bad data.`

I'll talk to them to see if they accept a PR to this change. In the meanwhile, you can do the same in your local setup to publish your app using vapor.