Pulling from Private Registry fails with 1.0.0

[MaxDaten]

Hi,

we just updated to version 1.0.0, thanks for providing this version!

However, a regression seems to be that pulling from private registries fails locally or in our pipeline if the image is not already present on the host. Because of the nature of private registries, it's not easily possible to provide a full-minimal reproduction

Steps to reproduce

1. Add a container with a private registry stored image to test (assume: xxx.azurecr.io/custom-image:latest)
2. Validate image is not already present on the local machine: docker images | grep xxx.azurecr.io/custom-image:latest
3. Execute the test using this image:

<?php

use PHPUnit\Framework\TestCase;
use Testcontainers\Container\GenericContainer;
use Testcontainers\Container\StartedGenericContainer;


class ContainerTestCase extends TestCase
{
    protected StartedGenericContainer $container;

    protected function setUp(): void
    {
        parent::setUp();
        $this->container = (new GenericContainer('xxx.azurecr.io/custom-image:latest'))
            ->start();
    }

    protected function tearDown(): void
    {
        $this->container->stop();
    }

    public function testContainerIsRunning(): void
    {
        $this->assertNotNull($this->container->getId());
    }
}

---

Fails with:

1) \project\Tests\Integration\models\ContainerTestCase::testContainerIsRunning
Docker\API\Exception\ImageCreateInternalServerErrorException: server error

/project/vendor/beluga-php/docker-php-api/src/Endpoint/ImageCreate.php:132
/project/vendor/beluga-php/docker-php/src/Endpoint/ImageCreate.php:20
/project/vendor/beluga-php/docker-php-api/src/Runtime/Client/EndpointTrait.php:18
/project/vendor/beluga-php/docker-php-api/src/Runtime/Client/Client.php:52
/project/vendor/beluga-php/docker-php/src/Docker.php:71
/project/vendor/testcontainers/testcontainers/src/Container/GenericContainer.php:474
/project/vendor/testcontainers/testcontainers/src/Container/GenericContainer.php:304
/project/tests/Integration/models/ContainerTestCase.php:25

Which indicates that the invocation of start() fails. Even when correctly authenticated with the docker registry.

Workaround: Pulling the image works. We have the same issue in github workflows. Docker is authenticated, either via login to the registry locally or adding the login action:

      - uses: docker/login-action@v3
        with:
          registry: xxx.azurecr.io
          username: ${{ secrets.CONTAINER_REGISTRY_USERNAME }}
          password: ${{ secrets.CONTAINER_REGISTRY_PASSWORD }}
      - name: 🧪Test
        run: |
          # Workaround testcontainer can't pull from private cr
          docker pull xxx.azurecr.io/custom-image:latest
          composer test:integration

[shyim]

I think we or the docker sdk need to parse the docker credentials. or @rw4lll do you have an better idea here?

[rw4lll]

@shyim @MaxDaten I could reproduce the issue. This feature is missing and we definitely need to implement it. First we should parse current credStore and add DOCKER_AUTH_CONFIG env support to be able to set it on the fly. I can take over this.

But actually the workaround is pretty straightforward: you can extend GenericContainer class and adjust pullImage method by adding auth header like in this snippet:

    protected function pullImage(): void
    {
        [$fromImage, $tag] = explode(':', $this->image) + [1 => 'latest'];
        /** @var CreateImageStream $imageCreateResponse */
        $imageCreateResponse = $this->dockerClient->imageCreate(
            null,
            [
            'fromImage' => $fromImage,
            'tag' => $tag,
        ],
            [
            'X-Registry-Auth' => base64_encode(json_encode([
                'username' => 'username',
                'password' => 'pat_token',
            ], JSON_THROW_ON_ERROR)),
        ]
        );
        $imageCreateResponse->wait();
    }