Merge pull request #23992 from secustor/feat/allow-private-registries

feat(packages/backend-common): allow to provide authentification to DockerContainerRunner

.changeset/tame-pianos-hunt.md

@@ -0,0 +1,5 @@
+---
+'@backstage/backend-common': patch
+---
+
+Added `pullOptions` to `DockerContainerRunner#runContainer` method to pass down options when pulling an image.

packages/backend-common/api-report.md

@@ -642,6 +642,21 @@ export { PluginDatabaseManager };
 
 export { PluginEndpointDiscovery };
 
+// @public
+export interface PullOptions {
+  // (undocumented)
+  [key: string]: unknown;
+  // (undocumented)
+  authconfig?: {
+    username?: string;
+    password?: string;
+    auth?: string;
+    email?: string;
+    serveraddress?: string;
+    [key: string]: unknown;
+  };
+}
+
 // @public
 export type ReaderFactory = (options: {
   config: Config;
@@ -740,6 +755,7 @@ export type RunContainerOptions = {
   envVars?: Record<string, string>;
   pullImage?: boolean;
   defaultUser?: boolean;
+  pullOptions?: PullOptions;
 };
 
 export { SearchOptions };

packages/backend-common/src/util/ContainerRunner.ts

@@ -16,6 +16,25 @@
 
 import { Writable } from 'stream';
 
+/**
+ *   Allows defining access credentials for a registry
+ *   Follows dockerode auth configuration:
+ *   {@link https://github.com/apocas/dockerode?tab=readme-ov-file#pull-from-private-repos}
+ *
+ *   @public
+ */
+export interface PullOptions {
+  authconfig?: {
+    username?: string;
+    password?: string;
+    auth?: string;
+    email?: string;
+    serveraddress?: string;
+    [key: string]: unknown;
+  };
+  [key: string]: unknown;
+}
+
 /**
  * Options passed to the {@link ContainerRunner.runContainer} method.
  *
@@ -31,6 +50,7 @@ export type RunContainerOptions = {
   envVars?: Record<string, string>;
   pullImage?: boolean;
   defaultUser?: boolean;
+  pullOptions?: PullOptions;
 };
 
 /**

packages/backend-common/src/util/DockerContainerRunner.test.ts

@@ -83,6 +83,30 @@ describe('DockerContainerRunner', () => {
     expect(mockDocker.run).toHaveBeenCalled();
   });
 
+  it('should pull the docker container with authentication', async () => {
+    await containerTaskApi.runContainer({
+      imageName,
+      args,
+      pullOptions: {
+        authconfig: {
+          auth: 'aaaaaaaaa',
+        },
+      },
+    });
+
+    expect(mockDocker.pull).toHaveBeenCalledWith(
+      imageName,
+      {
+        authconfig: {
+          auth: 'aaaaaaaaa',
+        },
+      },
+      expect.any(Function),
+    );
+
+    expect(mockDocker.run).toHaveBeenCalled();
+  });
+
   it('should not pull the docker container when pullImage is false', async () => {
     await containerTaskApi.runContainer({
       imageName,

packages/backend-common/src/util/DockerContainerRunner.ts

@@ -47,6 +47,7 @@ export class DockerContainerRunner implements ContainerRunner {
       envVars = {},
       pullImage = true,
       defaultUser = false,
+      pullOptions = {},
     } = options;
 
     // Show a better error message when Docker is unavailable.
@@ -61,7 +62,7 @@ export class DockerContainerRunner implements ContainerRunner {
 
     if (pullImage) {
       await new Promise<void>((resolve, reject) => {
-        this.dockerClient.pull(imageName, {}, (err, stream) => {
+        this.dockerClient.pull(imageName, pullOptions, (err, stream) => {
           if (err) return reject(err);
           stream.pipe(logStream, { end: false });
           stream.on('end', () => resolve());

packages/backend-common/src/util/index.ts

@@ -14,7 +14,11 @@
  * limitations under the License.
  */
 
-export type { ContainerRunner, RunContainerOptions } from './ContainerRunner';
+export type {
+  ContainerRunner,
+  RunContainerOptions,
+  PullOptions,
+} from './ContainerRunner';
 export { DockerContainerRunner } from './DockerContainerRunner';
 export type {
   KubernetesContainerRunnerOptions,