Error from docker.NewAuthConfigurationsFromDockerCfg() when auths is empty

[tschaub]

Preflight checklist

• I could not find a solution in the existing issues, docs, nor discussions.
• I agree to follow this project's Code of Conduct.
• I have read and am following this repository's Contribution Guidelines.
• I have joined the Ory Community Slack.
• I am signed up to the Ory Security Patch Newsletter.

Ory Network Project

No response

Describe the bug

When a ~/.docker/config.json file has an empty auths member, the docker.NewAuthConfigurationsFromDockerCfg() function returns a misleading error.

Reproducing the bug

Given this main.go:

package main

import (
	"fmt"
	"log"

	"github.com/ory/dockertest/v3/docker"
)

func main() {
	authConfigs, err := docker.NewAuthConfigurationsFromDockerCfg()
	if err != nil {
		log.Fatal(err)
	}

	fmt.Printf("auth configurations: %#v\n", authConfigs)
}

I see this error logged:

# go run main.go
2023/11/11 12:35:31 open /Users/tim/.dockercfg: no such file or directory
exit status 1

My Docker ~/.docker/config.json looks like this:

{
  "auths": {},
  "credHelpers": {
    "asia.gcr.io": "gcloud",
    "eu.gcr.io": "gcloud",
    "gcr.io": "gcloud",
    "marketplace.gcr.io": "gcloud",
    "staging-k8s.gcr.io": "gcloud",
    "us.gcr.io": "gcloud"
  },
  "credsStore": "desktop"
}

Relevant log output

No response

Relevant configuration

No response

Version

v3.10.0

On which operating system are you observing this issue?

macOS

In which environment are you deploying?

None

Additional Context

It looks like in the config.json parsing, if the auths object has no members:

dockertest/docker/auth.go

Lines 119 to 121 in f37306e

	if len(confsWrapper.Auths) > 0 {
	return confsWrapper.Auths, nil
	}

then an assumption is made that the config file will be a map[string]dockerConfig:

dockertest/docker/auth.go

Lines 124 to 127 in f37306e

	var confs map[string]dockerConfig
	if err := json.Unmarshal(byteData, &confs); err != nil {
	return nil, err
	}

The structure of my config.json doesn't match that. My config.json was recently updated after a docker logout ghcr.io.

# docker version
Client:
 Cloud integration: v1.0.29
 Version:           20.10.21
 API version:       1.41
 Go version:        go1.18.7
 Git commit:        baeda1f
 Built:             Tue Oct 25 18:01:18 2022
 OS/Arch:           darwin/arm64
 Context:           default
 Experimental:      true

Server: Docker Desktop 4.15.0 (93002)
 Engine:
  Version:          20.10.21
  API version:      1.41 (minimum version 1.12)
  Go version:       go1.18.7
  Git commit:       3056208
  Built:            Tue Oct 25 17:59:41 2022
  OS/Arch:          linux/arm64
  Experimental:     false
 containerd:
  Version:          1.6.10
  GitCommit:        770bd0108c32f3fb5c73ae1264f7e503fe7b2661
 runc:
  Version:          1.1.4
  GitCommit:        v1.1.4-0-g5fd4c4d
 docker-init:
  Version:          0.19.0
  GitCommit:        de40ad0

[kdescoteaux]

Part of the problem is that dockertest doesn't seem to have any support for docker-credential-<name> credential helpers.
Your config file specifies docker-credential-gcloud should be used for multiple registries.
Other config files might have empty entries under auth because they use the default platform helper, e.g. docker-credential-osxkeychain

	"auths": {
		"1234567890.dkr.ecr.us-east-1.amazonaws.com": {}
	},