Repository navigation
suddenly getting could not login to OCI registry "public.ecr.aws": error storing credentials - err: exit status 1, out: The stub received bad data. #835
Description
Description
Using:
resource "helm_release" "karpenter" {
repository = var.karpenter_chart_repository
name = var.karpenter_chart_release_name
chart = var.karpenter_chart_name
version = var.karpenter_chart_version
namespace = var.karpenter_chart_namespace
create_namespace = true
repository_username = data.aws_ecrpublic_authorization_token.ecr_token.user_name
repository_password = data.aws_ecrpublic_authorization_token.ecr_token.password
values = [yamlencode(local.chart_values)]
depends_on = [
aws_iam_instance_profile.karpenter_node
]
}
fails with:
could not login to OCI registry "public.ecr.aws": error storing credentials - err: exit status 1, out: The stub received bad data.
related to docker-credential-wincred ?
Reproduce
Run with rerraform:
resource "helm_release" "karpenter" {
repository = var.karpenter_chart_repository
name = var.karpenter_chart_release_name
chart = var.karpenter_chart_name
version = var.karpenter_chart_version
namespace = var.karpenter_chart_namespace
create_namespace = true
repository_username = data.aws_ecrpublic_authorization_token.ecr_token.user_name
repository_password = data.aws_ecrpublic_authorization_token.ecr_token.password
values = [yamlencode(local.chart_values)]
depends_on = [
aws_iam_instance_profile.karpenter_node
]
}
Expected behavior
Should not Faile error storing credentials.
docker version
Client:
Cloud integration: v1.0.35
Version: 24.0.2
API version: 1.43
Go version: go1.20.4
Git commit: cb74dfc
Built: Thu May 25 21:53:15 2023
OS/Arch: windows/amd64
Context: default
Server: Docker Desktop 4.21.1 (114176)
Engine:
Version: 24.0.2
API version: 1.43 (minimum version 1.12)
Go version: go1.20.4
Git commit: 659604f
Built: Thu May 25 21:52:17 2023
OS/Arch: linux/amd64
Experimental: false
containerd:
Version: 1.6.21
GitCommit: 3dce8eb055cbb6872793272b4f20ed16117344f8
runc:
Version: 1.1.7
GitCommit: v1.1.7-0-g860f061
docker-init:
Version: 0.19.0
GitCommit: de40ad0docker info
Client:
Version: 24.0.2
Context: default
Debug Mode: false
Plugins:
buildx: Docker Buildx (Docker Inc.)
Version: v0.11.0
Path: C:\Program Files\Docker\cli-plugins\docker-buildx.exe
compose: Docker Compose (Docker Inc.)
Version: v2.19.1
Path: C:\Program Files\Docker\cli-plugins\docker-compose.exe
dev: Docker Dev Environments (Docker Inc.)
Version: v0.1.0
Path: C:\Program Files\Docker\cli-plugins\docker-dev.exe
extension: Manages Docker extensions (Docker Inc.)
Version: v0.2.20
Path: C:\Program Files\Docker\cli-plugins\docker-extension.exe
init: Creates Docker-related starter files for your project (Docker Inc.)
Version: v0.1.0-beta.6
Path: C:\Program Files\Docker\cli-plugins\docker-init.exe
sbom: View the packaged-based Software Bill Of Materials (SBOM) for an image (Anchore Inc.)
Version: 0.6.0
Path: C:\Program Files\Docker\cli-plugins\docker-sbom.exe
scan: Docker Scan (Docker Inc.)
Version: v0.26.0
Path: C:\Program Files\Docker\cli-plugins\docker-scan.exe
scout: Command line tool for Docker Scout (Docker Inc.)
Version: 0.16.1
Path: C:\Program Files\Docker\cli-plugins\docker-scout.exe
Server:
Containers: 0
Running: 0
Paused: 0
Stopped: 0
Images: 0
Server Version: 24.0.2
Storage Driver: overlay2
Backing Filesystem: extfs
Supports d_type: true
Using metacopy: false
Native Overlay Diff: true
userxattr: false
Logging Driver: json-file
Cgroup Driver: cgroupfs
Cgroup Version: 1
Plugins:
Volume: local
Network: bridge host ipvlan macvlan null overlay
Log: awslogs fluentd gcplogs gelf journald json-file local logentries splunk syslog
Swarm: inactive
Runtimes: io.containerd.runc.v2 runc
Default Runtime: runc
Init Binary: docker-init
containerd version: 3dce8eb055cbb6872793272b4f20ed16117344f8
runc version: v1.1.7-0-g860f061
init version: de40ad0
Security Options:
seccomp
Profile: builtin
Kernel Version: 5.10.102.1-microsoft-standard-WSL2
Operating System: Docker Desktop
OSType: linux
Architecture: x86_64
CPUs: 12
Total Memory: 15.49GiB
Name: docker-desktop
ID: f4be5780-36b5-49bd-9c71-7bf9d1846adb
Docker Root Dir: /var/lib/docker
Debug Mode: false
HTTP Proxy: http.docker.internal:3128
HTTPS Proxy: http.docker.internal:3128
No Proxy: hubproxy.docker.internal
Experimental: false
Insecure Registries:
hubproxy.docker.internal:5555
127.0.0.0/8
Live Restore Enabled: false
WARNING: No blkio throttle.read_bps_device support
WARNING: No blkio throttle.write_bps_device support
WARNING: No blkio throttle.read_iops_device support
WARNING: No blkio throttle.write_iops_device supportDiagnostics ID
94AD17FA-CB59-4714-B2D2-8966B4B5F295/20230709051024
Activity
thaJeztah commentedon Jul 9, 2023
alimohsan1 commentedon Aug 6, 2025
The solution in this thread that worked for Windows
https://github.com/docker/docker-credential-helpers/issues/346#issuecomment-2672104757
igitur commentedon Nov 8, 2026
Same root cause as docker/docker-credential-helpers#190: the Windows Credential Manager caps a credential's
CredentialBlobat 2560 bytes, sodocker loginfails when the registry hands out a longer token (e.g. the ECR password with SSO).A fix is proposed for the
wincredhelper in docker/docker-credential-helpers#482 — secrets that don't fit stay in the same credential, spilling over into its credential attributes.Caveat: that only helps if
~/.docker/config.jsonuses"credsStore": "wincred". With"credsStore": "desktop"the failure comes from Docker Desktop's owndocker-credential-desktop.exe, which is not part of that repository and would need a separate fix.