at-container-registry
A container registry that uses the AT Protocol for manifest storage and S3 for blob storage. atcr.io
docker container atproto go
Star 110
Fork 2
Watch

Logging in with a read-only app passwords fails #26

Closed evan.jarrett.net
Closed opened by evan.jarrett.net

Logging in with a read-only app passwords (which might be a tranquil PDS specific features) fails with error Error response from daemon: Get "https://atcr.io/v2/": received unexpected HTTP status: 503 Service Unavailable. I tried this both directly and with the credential helper. Is there a reason why read-write access to my PDS would be needed if my only intent is to use this login to pull images? And would it be possible to get a better error message?

evan.jarrett.net

For feuri.de (did:plc:valvnpvx5ggq2feghskeeb4b), the login itself does not fail on the password. The sequence is:

  1. Docker hits /v2/ → 401 with a challenge pointing at /auth/token (normal).
  2. /auth/token runs with your Basic Auth creds. com.atproto.server.createSession succeeds (your app password is valid).
  3. The handler then tries to pre-mint a service-auth token by calling com.atproto.server.getServiceAuth on your PDS (pds.sqrl.systems), scoped to lxm=com.atproto.repo.getRecord, aud=.
  4. Your PDS rejects that with 403 InsufficientScope — because it's a read-only app password.

I don't know if there is a way to say "read only and allow read-only service-auth requests" for tranquil pds.

I can fix the error message to surface the 403 in docker

feuri.de

That does indeed sound like a limitation on the tranquil side, thanks for checking. Te current options for app passwords are "Full Access", "Read Only" and "Post only". I don't know nearly enough about the tranquil internals to give any more details about that.

Having a proper error message would be nice though.

Sign up or Sign in to add to the discussion.