{"action":"created","issue":{"url":"https://api.github.com/repos/docker/docker/issues/23390","repository_url":"https://api.github.com/repos/docker/docker","labels_url":"https://api.github.com/repos/docker/docker/issues/23390/labels{/name}","comments_url":"https://api.github.com/repos/docker/docker/issues/23390/comments","events_url":"https://api.github.com/repos/docker/docker/issues/23390/events","html_url":"https://github.com/docker/docker/issues/23390","id":159304019,"number":23390,"title":"Ignore docker login -e option flag","user":{"login":"sentientmonkey","id":9032,"avatar_url":"https://avatars.githubusercontent.com/u/9032?v=3","gravatar_id":"","url":"https://api.github.com/users/sentientmonkey","html_url":"https://github.com/sentientmonkey","followers_url":"https://api.github.com/users/sentientmonkey/followers","following_url":"https://api.github.com/users/sentientmonkey/following{/other_user}","gists_url":"https://api.github.com/users/sentientmonkey/gists{/gist_id}","starred_url":"https://api.github.com/users/sentientmonkey/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sentientmonkey/subscriptions","organizations_url":"https://api.github.com/users/sentientmonkey/orgs","repos_url":"https://api.github.com/users/sentientmonkey/repos","events_url":"https://api.github.com/users/sentientmonkey/events{/privacy}","received_events_url":"https://api.github.com/users/sentientmonkey/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":4,"created_at":"2016-06-09T00:10:14Z","updated_at":"2016-06-10T00:43:03Z","closed_at":null,"body":"The following PR removed the email address from login: \r\nhttps://github.com/docker/docker/pull/20565 \r\n\r\nThis left the -e flag as a warning to customers, and is slated for deprecation in docker 1.13. \r\n\r\nThe AWS CLI relies on the docker login command for authentication with the EC2 Container Registry. \r\nhttps://github.com/aws/aws-cli/blob/develop/awscli/customizations/ecr.py#L55\r\n\r\nIf this flag is removed in the AWS CLI, customers using older version of docker (1.10 or older) will no longer be able to login without upgrading docker or downgrading the AWS CLI.\r\n\r\nI'd like to propose that newer versions of docker silently ignore this flag, or accept \"-e none\" as a valid option, and not deprecate the flag."},"comment":{"url":"https://api.github.com/repos/docker/docker/issues/comments/225066839","html_url":"https://github.com/docker/docker/issues/23390#issuecomment-225066839","issue_url":"https://api.github.com/repos/docker/docker/issues/23390","id":225066839,"user":{"login":"sentientmonkey","id":9032,"avatar_url":"https://avatars.githubusercontent.com/u/9032?v=3","gravatar_id":"","url":"https://api.github.com/users/sentientmonkey","html_url":"https://github.com/sentientmonkey","followers_url":"https://api.github.com/users/sentientmonkey/followers","following_url":"https://api.github.com/users/sentientmonkey/following{/other_user}","gists_url":"https://api.github.com/users/sentientmonkey/gists{/gist_id}","starred_url":"https://api.github.com/users/sentientmonkey/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sentientmonkey/subscriptions","organizations_url":"https://api.github.com/users/sentientmonkey/orgs","repos_url":"https://api.github.com/users/sentientmonkey/repos","events_url":"https://api.github.com/users/sentientmonkey/events{/privacy}","received_events_url":"https://api.github.com/users/sentientmonkey/received_events","type":"User","site_admin":false},"created_at":"2016-06-10T00:43:03Z","updated_at":"2016-06-10T00:43:03Z","body":"Thanks for the suggestion.  When we were thinking through this interaction initially, we were concerned with the risks for credential exposure, escalation of privilege, and functionality that would be introduced by invoking another executable on your PATH or making a call to an already-privileged process like the Docker daemon.  As an additional component in the design, we were concerned about portability between different end-user systems (making sure the same process works for customers on Linux, Windows, or Mac).  There are a few cases that deserve some examples:\r\n\r\n* Invoking a process on PATH risks that a malicious executable placed earlier on the PATH may get invoked instead\r\n\r\n* Making a call to the Docker daemon through a socket risks privilege escalation for a user who is in the 'docker' group (or whatever group is set on the Docker daemon)\r\n\r\n* Making a call to the Docker daemon through the socket could fail if the current user is not privileged (and not part of the 'docker' group)\r\n\r\n* The Docker daemon might not be available at a socket, but instead at a TCP endpoint potentially secured with a certificate\r\n\r\nThere is more documentation around the `get-login` command here:\r\nhttp://docs.aws.amazon.com/cli/latest/reference/ecr/get-login.html"}}
{"actor":{"display_login":"sentientmonkey"}}