cli/command: use the Docker Desktop session for Docker Hub

When Docker Desktop is running and signed in, read the Docker Hub session from the Docker Desktop secrets engine, and send it as the registry credentials for Docker Hub (docker.io) and Docker Hardened Images (dhi.io) when pulling or pushing images through the daemon: docker pull, push, run, create, plugin install and push, service create and update, and stack deploy.

Credentials in DOCKER_AUTH_CONFIG take precedence for the registries they cover. Without a usable Docker Desktop session (no socket, nothing listening, signed out, or no answer within 5 seconds), the CLI uses its credential store, credential helpers, and configuration file as before. docker login and stored credentials are not changed.

Signed-off-by: Alano Terblanche <18033717+Benehiko@users.noreply.github.com>
This commit is contained in:
Alano Terblanche
2026-10-22 11:21:50 +02:00
parent 0c2d0f700c
commit a46376f216
3 changed files with 248 additions and 3 deletions
+12
View File
@@ -70,6 +70,18 @@ With Docker Desktop, the credential store is already installed and configured
for you. Unless you want to change the credential store used by Docker Desktop,
you can skip the following steps.
#### Docker Desktop sign-in
When Docker Desktop is running and you are signed in, commands that pull or
push images through the Docker Engine, such as `docker pull`, `docker push`,
`docker run`, and `docker service create`, use the Docker Desktop session for
Docker Hub (`docker.io`) and Docker Hardened Images (`dhi.io`). The session is
used before the credential store, credential helpers, and the configuration
file. Credentials set in the `DOCKER_AUTH_CONFIG` environment variable take
precedence over the Docker Desktop session. If Docker Desktop is not installed
or not running, or you are not signed in, the Docker CLI uses its own
credentials.
#### Configure the credential store
You need to specify the credential store in `$HOME/.docker/config.json`