Docker: Using --password via the CLI is insecure.

Question

I have this error when I login during a CI process:

WARNING! Using --password via the CLI is insecure. Use --password-stdin.

Should I just replace "--password" with "--password-stdin'?

Answer 1

According to docker documentation:

To run the docker login command non-interactively, you can set the --password-stdin flag to provide a password through STDIN. Using STDIN prevents the password from ending up in the shell’s history, or log-files.

The following examples read a password from a file, and passes it to the docker login command using STDIN:

$ cat ~/my_password.txt | docker login --username foo --password-stdin

or

$ docker login --username foo --password-stdin < ~/my_password

The following example reads a password from a variable, and passes it to the docker login command using STDIN:

$ echo "$MY_PASSWORD" | docker login --username foo --password-stdin

Answer 2

This is a warning one commonly gets using AWS. If this is the case, another solution to the problem could be not explicitly running the command so that it gets stored in the history. To do this, one could use (with aws2)

eval $(aws2 ecr get-login --no-include-email)

Even though you will still see the warning, the explicit docker command containing the key/password is not stored in the bash history. If unconvinced, try running the history command to see for yourself.

Answer 3

The same echo command on a Windows based system (or when running in an Azure Pipelines task based on vs2017-win2016) does also output an additional newline.

A workaround for this to use set /p, see also question + answer.

The full command will be like:
echo | set /p="my_password" | docker login --username foo --password-stdin