feat(packages/backend-common): allows providing authentification in parameters

Signed-off-by: secustor <sebastian@poxhofer.at>

.changeset/tame-pianos-hunt.md

@@ -0,0 +1,5 @@
+---
+'@backstage/backend-common': minor
+---
+
+Allow to provide authentification which in turn allows usage of private registries

packages/backend-common/src/util/ContainerRunner.ts

@@ -16,6 +16,21 @@
 
 import { Writable } from 'stream';
 
+/**
+ *   Allows defining access credentials for a registry
+ *   Follows dockerode auth configuration:
+ *   {@link https://github.com/apocas/dockerode?tab=readme-ov-file#pull-from-private-repos}
+ *
+ *   @public
+ */
+export interface DockerAuthentication {
+  username?: string;
+  password?: string;
+  auth?: string;
+  email?: string;
+  serveraddress?: string;
+}
+
 /**
  * Options passed to the {@link ContainerRunner.runContainer} method.
  *
@@ -31,6 +46,7 @@ export type RunContainerOptions = {
   envVars?: Record<string, string>;
   pullImage?: boolean;
   defaultUser?: boolean;
+  authentication?: DockerAuthentication;
 };
 
 /**

packages/backend-common/src/util/DockerContainerRunner.test.ts

@@ -83,6 +83,28 @@ describe('DockerContainerRunner', () => {
     expect(mockDocker.run).toHaveBeenCalled();
   });
 
+  it('should pull the docker container with authentication', async () => {
+    await containerTaskApi.runContainer({
+      imageName,
+      args,
+      authentication: {
+        auth: 'aaaaaaaaa',
+      },
+    });
+
+    expect(mockDocker.pull).toHaveBeenCalledWith(
+      imageName,
+      {
+        authconfig: {
+          auth: 'aaaaaaaaa',
+        },
+      },
+      expect.any(Function),
+    );
+
+    expect(mockDocker.run).toHaveBeenCalled();
+  });
+
   it('should not pull the docker container when pullImage is false', async () => {
     await containerTaskApi.runContainer({
       imageName,

packages/backend-common/src/util/DockerContainerRunner.ts

@@ -47,6 +47,7 @@ export class DockerContainerRunner implements ContainerRunner {
       envVars = {},
       pullImage = true,
       defaultUser = false,
+      authentication,
     } = options;
 
     // Show a better error message when Docker is unavailable.
@@ -61,13 +62,17 @@ export class DockerContainerRunner implements ContainerRunner {
 
     if (pullImage) {
       await new Promise<void>((resolve, reject) => {
-        this.dockerClient.pull(imageName, {}, (err, stream) => {
-          if (err) return reject(err);
-          stream.pipe(logStream, { end: false });
-          stream.on('end', () => resolve());
-          stream.on('error', (error: Error) => reject(error));
-          return undefined;
-        });
+        this.dockerClient.pull(
+          imageName,
+          { authconfig: authentication },
+          (err, stream) => {
+            if (err) return reject(err);
+            stream.pipe(logStream, { end: false });
+            stream.on('end', () => resolve());
+            stream.on('error', (error: Error) => reject(error));
+            return undefined;
+          },
+        );
       });
     }