feat(cli): add TRIGGER_REGISTRY_AUTH=file registry auth mode

When TRIGGER_REGISTRY_AUTH=file is set, deploys write the registry auth
entry into the docker config file directly instead of running docker
login, and remove it where docker logout ran. Intended for the managed
build server, where the config is job-scoped and helper-less; machines
with a credential helper configured must keep the default login mode,
since docker ignores inline auth entries when credsStore is set.

Author: myftija

.changeset/thick-otters-swim.md

@@ -0,0 +1,5 @@
+---
+"trigger.dev": patch
+---
+
+Adds TRIGGER_REGISTRY_AUTH=file: deploys authenticate to the registry by writing the docker config auth entry directly instead of running docker login.

packages/cli-v3/src/deploy/buildImage.ts

@@ -5,6 +5,9 @@ import type { BuildManifest, BuildRuntime } from "@trigger.dev/core/v3/schemas";
 import { networkInterfaces } from "os";
 import { join } from "path";
 import { safeReadJSONFile } from "../utilities/fileSystem.js";
+import { mkdir, writeFile } from "node:fs/promises";
+import { homedir } from "os";
+import { dirname } from "path";
 import { readFileSync } from "fs";
 
 import { isLinux } from "std-env";
@@ -474,6 +477,12 @@ async function localBuildImage(options: SelfHostedBuildImageOptions): Promise<Bu
 
   const errors: string[] = [];
 
+  const writeRegistryAuthFile = process.env.TRIGGER_REGISTRY_AUTH === "file";
+  const dockerConfigPath = join(
+    process.env.DOCKER_CONFIG ?? join(homedir(), ".docker"),
+    "config.json"
+  );
+
   let cloudRegistryHost: string | undefined;
   if (push && options.authenticateToRegistry) {
     cloudRegistryHost =
@@ -499,32 +508,48 @@ async function localBuildImage(options: SelfHostedBuildImageOptions): Promise<Bu
       };
     }
 
-    logger.debug(`Logging in to docker registry: ${cloudRegistryHost}`);
+    if (writeRegistryAuthFile) {
+      logger.debug(`Writing registry auth for ${cloudRegistryHost} to ${dockerConfigPath}`);
+
+      const [writeError] = await tryCatch(
+        upsertRegistryAuth(dockerConfigPath, cloudRegistryHost, credentials)
+      );
 
-    const loginProcess = x(
-      "docker",
-      ["login", "--username", credentials.username, "--password-stdin", cloudRegistryHost],
-      {
-        nodeOptions: {
-          cwd: options.cwd,
-        },
+      if (writeError) {
+        return {
+          ok: false as const,
+          error: `Failed to write registry auth for ${cloudRegistryHost}: ${writeError.message}`,
+          logs: "",
+        };
       }
-    );
+    } else {
+      logger.debug(`Logging in to docker registry: ${cloudRegistryHost}`);
+
+      const loginProcess = x(
+        "docker",
+        ["login", "--username", credentials.username, "--password-stdin", cloudRegistryHost],
+        {
+          nodeOptions: {
+            cwd: options.cwd,
+          },
+        }
+      );
 
-    loginProcess.process?.stdin?.write(credentials.password);
-    loginProcess.process?.stdin?.end();
+      loginProcess.process?.stdin?.write(credentials.password);
+      loginProcess.process?.stdin?.end();
 
-    for await (const line of loginProcess) {
-      errors.push(line);
-      logger.debug(line);
-    }
+      for await (const line of loginProcess) {
+        errors.push(line);
+        logger.debug(line);
+      }
 
-    if (loginProcess.exitCode !== 0) {
-      return {
-        ok: false as const,
-        error: `Failed to login to registry: ${cloudRegistryHost}`,
-        logs: extractLogs(errors),
-      };
+      if (loginProcess.exitCode !== 0) {
+        return {
+          ok: false as const,
+          error: `Failed to login to registry: ${cloudRegistryHost}`,
+          logs: extractLogs(errors),
+        };
+      }
     }
 
     options.onLog?.(`Successfully logged in to the remote registry`);
@@ -610,8 +635,7 @@ async function localBuildImage(options: SelfHostedBuildImageOptions): Promise<Bu
 
   if (buildProcess.exitCode !== 0) {
     if (cloudRegistryHost) {
-      logger.debug(`Logging out from docker registry: ${cloudRegistryHost}`);
-      await x("docker", ["logout", cloudRegistryHost]);
+      await clearRegistryAuth(cloudRegistryHost, writeRegistryAuthFile, dockerConfigPath);
     }
 
     return {
@@ -660,8 +684,7 @@ async function localBuildImage(options: SelfHostedBuildImageOptions): Promise<Bu
   }
 
   if (cloudRegistryHost) {
-    logger.debug(`Logging out from docker registry: ${cloudRegistryHost}`);
-    await x("docker", ["logout", cloudRegistryHost]);
+    await clearRegistryAuth(cloudRegistryHost, writeRegistryAuthFile, dockerConfigPath);
   }
 
   return {
@@ -672,6 +695,41 @@ async function localBuildImage(options: SelfHostedBuildImageOptions): Promise<Bu
   };
 }
 
+async function upsertRegistryAuth(
+  configPath: string,
+  host: string,
+  credentials: { username: string; password: string }
+) {
+  const config = ((await safeReadJSONFile(configPath)) ?? {}) as {
+    auths?: Record<string, { auth?: string }>;
+  };
+  config.auths = {
+    ...config.auths,
+    [host]: {
+      auth: Buffer.from(`${credentials.username}:${credentials.password}`).toString("base64"),
+    },
+  };
+  await mkdir(dirname(configPath), { recursive: true });
+  await writeFile(configPath, JSON.stringify(config), { mode: 0o600 });
+}
+
+async function clearRegistryAuth(host: string, viaAuthFile: boolean, configPath: string) {
+  if (!viaAuthFile) {
+    logger.debug(`Logging out from docker registry: ${host}`);
+    await x("docker", ["logout", host]);
+    return;
+  }
+
+  const config = (await safeReadJSONFile(configPath)) as
+    | { auths?: Record<string, unknown> }
+    | undefined;
+  if (!config?.auths?.[host]) {
+    return;
+  }
+  delete config.auths[host];
+  await writeFile(configPath, JSON.stringify(config), { mode: 0o600 });
+}
+
 function extractLogs(outputs: string[]) {
   // Remove empty lines
   const cleanedOutputs = outputs.map((line) => line.trim()).filter((line) => line !== "");