OCI from hub.docker.com

1

Hello,

Long version of OCI from hub.docker.com

Problem that I want to solve is getting beyond error message

Error: Failed instance creation: Failed getting remote image info:
  Failed to run: skopeo --insecure-policy inspect docker://dhi.io/harbor-portal:2-debian-dev --no-tags: exit status 1
  (time="2026-08-24T20:30:35+02:00" level=fatal msg="Error parsing image name \"docker://dhi.io/harbor-portal:2-debian-dev\":
  unable to retrieve auth token: invalid username/password: authentication required")

What I really want is running Harbor in incus.

According Hardened Images catalog | Harbor Portal | Images | Docker Hub plus button Use this image need I to do

docker login dhi.io

How to do that login?

Additional information:

$ incus remote list | grep dhi | cut -b -72
| dhi             | https://dhi.io                     | oci           |
$

The error in context:

$ incus launch dhi:harbor-portal:2-debian-dev harbor
Launching harbor
Error: Failed instance creation: Failed getting remote image info:
  Failed to run: skopeo --insecure-policy inspect docker://dhi.io/harbor-portal:2-debian-dev --no-tags:
  exit status 1 (time="2026-08-24T20:30:35+02:00" level=fatal
  msg="Error parsing image name \"docker://dhi.io/harbor-portal:2-debian-dev\":
  unable to retrieve auth token: invalid username/password: authentication required")
$
2

You need a --credentials-helper like GitHub - docker/docker-credential-helpers: Programs to keep Docker login credentials safe by storing in platform keystores · GitHub

3

I’m working on it

Long version:

Executable docker-credential-pass is in Debian package golang-docker-credential-helpers. So you have to do:

sudo apt install --yes golang-docker-credential-helpers

From its manual page got I a hint to pass, https://www.passwordstore.org/ my favorite password manager.

Some exercises with it:

$ docker-credential-pass list
{}
$ echo '{ "ServerURL": "https://repo.example.com", "Username": "alice", "Secret": "eXpos3d"}' | docker-credential-pass store
$ docker-credential-pass list
{"https://repo.example.com":"alice"}
$ echo https://repo.example.com | docker-credential-pass get
{"ServerURL":"https://repo.example.com","Username":"alice","Secret":"eXpos3d"}
$

to be continued …

4

Not there yet still getting unable to retrieve auth token: invalid username/password: authentication required.

Creating a fresh topic for that failure.

5

Server and client on the same box?

6

Yes, C &S on same laptop (Debian Forky)

7

I can imagine (I have no clue) that the “root” user incus is running as doesn’t get the password.

8

That’s not how the credentials helper works. The CLI is the one doing the login and getting the authentication token, then the URL with the token is passed to the server (Incus).

If we needed Incus itself (daemon) to be able to run the credential helper, we’d have quite a headache on our hands what with clusters and IncusOS and the like.