A container registry that uses the AT Protocol for manifest storage and S3 for blob storage. atcr.io

Fork 2

Unable to push image `no session found for DID` #30

Closed

evan.jarrett.net 1mo ago

Closed opened by

evan.jarrett.net 1mo ago

Hello! I'm trying to push the latest docker image for tranquil-pds using delegated access to tranquil.farm. I'm able to log in, although in Firefox I get redirected to https://atcr.io/api/devices which renders as JSON in my browser. If I then go to https://atcr.io it shows me as logged in.

I've installed the credential helper and logged in with docker-credential-atcr login. It shows me as logged in, and I can see my device in settings in https://atcr.io.

When I attempt to push a new image I get these errors:

 > exporting to image:
7.609 error: failed commit on ref "manifest-sha256:8aba2a752077ed6487fdfd182b5a78c1ea6394e54cff307508b9cdc539bfdc7a": unexpected status from PUT request to https://atcr.io/v2/tranquil.farm/tranquil-pds/manifests/sha256:8aba2a752077ed6487fdfd182b5a78c1ea6394e54cff307508b9cdc539bfdc7a: 500 Internal Server Error
7.609 unknown: unknown error
7.609 retrying in 1s
9.279 error: failed commit on ref "manifest-sha256:8aba2a752077ed6487fdfd182b5a78c1ea6394e54cff307508b9cdc539bfdc7a": unexpected status from PUT request to https://atcr.io/v2/tranquil.farm/tranquil-pds/manifests/sha256:8aba2a752077ed6487fdfd182b5a78c1ea6394e54cff307508b9cdc539bfdc7a: 500 Internal Server Error
9.279 unknown: unknown error
9.279 retrying in 2s
12.08 error: failed commit on ref "manifest-sha256:8aba2a752077ed6487fdfd182b5a78c1ea6394e54cff307508b9cdc539bfdc7a": unexpected status from PUT request to https://atcr.io/v2/tranquil.farm/tranquil-pds/manifests/sha256:8aba2a752077ed6487fdfd182b5a78c1ea6394e54cff307508b9cdc539bfdc7a: 500 Internal Server Error
12.08 unknown: unknown error
12.08 retrying in 4s
17.04 error: failed commit on ref "manifest-sha256:8aba2a752077ed6487fdfd182b5a78c1ea6394e54cff307508b9cdc539bfdc7a": unexpected status from PUT request to https://atcr.io/v2/tranquil.farm/tranquil-pds/manifests/sha256:8aba2a752077ed6487fdfd182b5a78c1ea6394e54cff307508b9cdc539bfdc7a: 500 Internal Server Error
17.04 unknown: unknown error
------
ERROR: failed to build: failed to solve: failed to push atcr.io/tranquil.farm/tranquil-pds:0.6.7: unknown: unknown error - failed to upload manifest blob: uploadBlob failed: no session found for DID: did:web:tranquil.tranquil.farm

and if I go back to https://atcr.io I am no longer logged in. I've tried 4-5 times, different browsers etc. It consistently happens the same way each time.

jola.dev 1mo ago

Just to add, I'm able to push to my account directly, just not to tranquil.farm https://atcr.io/r/jola.dev/tranquil-pds#overview

jola.dev 1mo ago

Ok turns out it was because we were running an old version of tranquil that was failing to show a scope on the OAuth screen, so we couldn't accept it. atcr.io then killed the session whenever we tried to do something we didn't have permission to do, which, maybe it should return a forbidden instead and maintain the session?

Feel free to close this!

evan.jarrett.net 1mo ago

I believe the logout functionality is fixed in future deployments. But basically an assumed role implementation from a third party pds isn’t something I’m currently supporting. At some point i want to look into better support for tranquil as Ive gotten a handful of these type of “it doesn't work with special tranquil feature”

jola.dev 1mo ago

Oh to clarify it turned out not to be related to delegated accounts at all. What happened was that the session was missing a scope, and instead of returning 403 forbidden, because my session did not have the scope to write the manifest records, it 500ed and deleted the session.

I’m suggesting you could return 403 instead and not kill the session, when the issue is a missing permission.

jola.dev 1mo ago

Oh and it actually accepts the pushed layers even if you are missing the required permissions to finish the image upload. It 500s at the end of each layer when it tries to write the atproto records. The permission check should probably happen at the start?

evan.jarrett.net 1mo ago

Based on your initial report, it looks like you were trying to push to an account you didn’t own. Now you are just saying you didnt have the correct scope, which under a normal session login shouldn’t be the case. Yes a check at the beginning would be better, but layer records get garbage collected later if no manifest exists. I have addressed some of the 500s in later deployments but atcr.io is 5 months behind and doesn’t have all the fixes.

evan.jarrett.net 1mo ago

Doing some cleanup to prevent the 500s and warn users on a login with missing scopes.