54 lines
1.9 KiB
Bash
54 lines
1.9 KiB
Bash
cat <<EOF
|
|
Moving to a credentials store like gnome-keyring or keepassxc take some
|
|
understanding and policy on the structure and handling of password databases.
|
|
|
|
This will squash the existing auth section of the ~/.docker/config.json
|
|
(copied to config.json.bak) and force the use by docker of the system keystore.
|
|
EOF
|
|
|
|
exit 0
|
|
# When the tools needed for docker to use a keyring store are installed
|
|
# they bring in gnome-keyring as a dependency. So we put it here so that
|
|
# we can we can disable gnome-keyring in favour of a choice of our own.
|
|
# see 020_keepassxc.sh
|
|
|
|
# dockerpycreds will bring in gnome-keyring and golang-docker-credential-helpers
|
|
# which provides the executables needed for docker to use a keyring
|
|
# We need /usr/bin/docker-credential-pass
|
|
# /usr/bin/docker-credential-secretservice
|
|
sudo apt-get install -y golang-docker-credential-helpers
|
|
|
|
sudo apt-get install -y \
|
|
python3-dockerpycreds \
|
|
libsecret-tools
|
|
|
|
# prevent gnome-keyring from becoming active
|
|
# https://askubuntu.com/questions/545172/how-do-i-disable-gnome-keyring-ssh-integration
|
|
# https://devopstales.github.io/home/docker-credential-in-keepassxc/
|
|
# Rename the daemon executable
|
|
sudo dpkg-divert --local --rename /usr/bin/gnome-keyring-daemon
|
|
# which returns:
|
|
# Adding 'local diversion of /usr/bin/gnome-keyring-daemon to /usr/bin/gnome-keyring-daemon.distrib'
|
|
|
|
# re-enable with:
|
|
# sudo dpkg-divert --remove --rename /usr/bin/gnome-keyring-daemon
|
|
|
|
# replace the auth section in ~/.docker/config.yml with a credentials store.
|
|
DEST=${1:-/etc/skel}
|
|
CONFIG_PATH="${DEST}/.docker"
|
|
FILE="config.json"
|
|
mkdir -p ${CONFIG_PATH}
|
|
|
|
# create the json file if it doesn't exist
|
|
if [ ! -f "${CONFIG_PATH}/${FILE}" ]; then
|
|
echo '{}' >${CONFIG_PATH}/${FILE}
|
|
else
|
|
cp ${CONFIG_PATH}/${FILE} ${CONFIG_PATH}/${FILE}.bak
|
|
fi
|
|
|
|
# delete the auth section
|
|
jq 'del(.auths)' ${FILE} | sponge ${FILE}
|
|
|
|
# add the creditials store
|
|
jq '. + {"credsStore": "secret-service"}' ${FILE} | sponge ${FILE}
|