Docker: Using --password via the CLI is insecure. Use --password-stdin

Question

I have the following warning when I log in to my registry during a continuous integration (CI) process:

WARNING! Using --password via the CLI is insecure. Use --password-stdin.

Should I just replace --password with --password-stdin?

Answer 1

According to docker documentation:

To run the docker login command non-interactively, you can set the --password-stdin flag to provide a password through STDIN. Using STDIN prevents the password from ending up in the shell’s history, or log-files.

The following examples read a password from a file, and passes it to the docker login command using STDIN:

$ cat ~/my_password.txt | docker login --username foo --password-stdin

or

$ docker login --username foo --password-stdin < ~/my_password

The following example reads a password from a variable, and passes it to the docker login command using STDIN:

$ echo "$MY_PASSWORD" | docker login --username foo --password-stdin

Answer 2

The same echo command on a Windows based system (or when running in an Azure Pipelines task based on vs2017-win2016) does also output an additional newline.

A workaround for this to use set /p, see also question + answer.

The full command will be like:
echo | set /p="my_password" | docker login --username foo --password-stdin

Answer 3

Windows 10 solution using powershell:

Use Notepad to create a one line text file with your password. The file was named "password1.txt" for the command line below to work.
Save this file in the folder you are using in powershell (...typically C:\Users\Your_Username ).

Get-Content password1.txt | docker login --username my_username --password-stdin

Refer: Redirecting standard input\output in Windows PowerShell

Answer 4

This is a warning one commonly gets using AWS. If this is the case, another solution to the problem could be not explicitly running the command so that it gets stored in the history. To do this, one could use (with aws2)

eval $(aws2 ecr get-login --no-include-email)

Even though you will still see the warning, the explicit docker command containing the key/password is not stored in the bash history. If unconvinced, try running the history command to see for yourself.

Answer 5

Setup in github actions:

echo ${{ secrets.DOCKER_TOKEN }} | docker login --username ${{ secrets.DOCKER_USERNAME }} --password-stdin