[WSL2] docker pull works only when executed with sudo

[ad-on-is]

I just realised that when using Docker inside WSL2, the pull command is not working. When executing docker pull image it just hangs there doing nothing. Restarted Docker, WSL and even my computer, without success. But when using sudo docker pull image it works. This used to work previously. Did something change regarding the permissions?

docker -v, docker ps... etc. all works.
The user has the docker group assigned to it.

System

Docker 2.3.3.2 (46784)
Windows 10 20175
WSL2: Ubuntu 20.04

Expected behaviour (Works from within PowerShell)

docker pull nginx
latest: Pulling from library/nginx
6ec8c9369e08: Pull complete
d3cb09a117e5: Pull complete
7ef2f1459687: Pull complete
e4d1bf8c9482: Pull complete
795301d236d7: Pull complete
Digest: sha256:0e188877aa60537d1a1c6484b8c3929cfe09988145327ee47e8e91ddf6f76f5c
Status: Downloaded newer image for nginx:latest
docker.io/library/nginx:latest

Actual behaviour (from WSL2)

docker pull nginx
Using default tag: latest
[hangs]

sudo docker pull nginx
Using default tag: latest
latest: Pulling from library/nginx
6ec8c9369e08: Pull complete
d3cb09a117e5: Pull complete
7ef2f1459687: Pull complete
e4d1bf8c9482: Pull complete
795301d236d7: Pull complete
Digest: sha256:0e188877aa60537d1a1c6484b8c3929cfe09988145327ee47e8e91ddf6f76f5c
Status: Downloaded newer image for nginx:latest
docker.io/library/nginx:latest

Observations

Removing ~/.docker/config.json seems to solve the issue, but this file is re-created after restarting Docker or rebooting Windows.

[stephen-turner]

That's weird. Any ideas, @simonferquel?

[n10000k]

@ad-on-is what WSL2 distro are you running? Can you try use Ubuntu and confirm if you've got the same issue, could be that the distro you're using has some kind of elevated permission system. I just tested on a clean install, latest version of everything with the Ubuntu WSL2 and it works fine.

[shandak]

@ad-on-is I've just faced with the same things. Try to delete rm ~/.docker/config.json file from your distro. It helped me.

[ad-on-is]

@ad-on-is what WSL2 distro are you running? Can you try use Ubuntu and confirm if you've got the same issue, could be that the distro you're using has some kind of elevated permission system. I just tested on a clean install, latest version of everything with the Ubuntu WSL2 and it works fine.

I have Ubuntu 20.04 (as described) as my default distro and Kali for occasional use-cases. Non of them are able to execute the pull command without sudo. But this used to work previously. Although I didn't change anything except updating Windows and Docker, so there must have happened something in one of the updates, that caused this issue.

[ad-on-is]

@ad-on-is I've just faced with the same things. Try to delete rm ~/.docker/config.json file from your distro. It helped me.

I'll give it a try. Will this have any side-effects? Will that file be recreated by Docker again?

[shandak]

@ad-on-is I've just faced with the same things. Try to delete rm ~/.docker/config.json file from your distro. It helped me.

I'll give it a try. Will this have any side-effects? Will that file be recreated by Docker again?

As I can see - no, so far it no longer exist but everything is working now.

[shandak]

Well, the issue is back after PC restart.
It creates file ~/.docker/config.json again with "credsStore":"desktop.exe"
And it's working again only when I remove this variable.
Similar issues there https://github.com/docker/compose/issues/7495 and there #6652

[ad-on-is]

Well, the issue is back after PC restart.
It creates file ~/.docker/config.json again with "credsStore":"desktop.exe"
And it's working again only when I remove this variable.
Similar issues there docker/compose#7495 and there #6652

These are all docker-compose related issues. Strangely docker-compose works without problems. I remember having an issue where it didn't work some weeks ago, and the symlink-solution fixed it since then, and it still works.

Removing only the credsStore var, does it recreate credsStore again after restart?

[omardelrio]

This also breaks VS Code container support (it hangs while trying to pull any base image you use in your container). This is using docker-compose too.

For now, the workaround for me was to delete config.json and then docker login from WSL2 (my distro is Ubuntu 20). VS Code and docker from the WSL2 terminal work fine now.

I haven't restarted, but I suspect config.json will be rewritten with credsStore = desktop.

[n10000k]

You shouldn't need to delete the config.json when you do docker login that should overwrite it regardless.

Seems like a issue with your WSL2 and the symlink reading from the credStore.

Have you tried this? #6652 (comment)

[omardelrio]

My Windows path was already in wsl2, I just tried with the symlink and same thing- it just hangs trying to pull the image.

I had to delete config.json, otherwise docker login would hang too - just double checked. Restarting adds "credsStore":"desktop.exe" to the file.

[n10000k]

My Windows path was already in wsl2, I just tried with the symlink and same thing- it just hangs trying to pull the image.

I had to delete config.json, otherwise docker login would hang too - just double checked. Restarting adds "credsStore":"desktop.exe" to the file.

Your issue seems to be with WSL2 and not Docker directly. I've tested this on a workbench, latest version Windows, latest version Docker, Ubuntu (18.04) distro and can't replicate this issue. My only conclusion would be the symlink between docker-credential-wincred.exe is hanging, however that would also throw a python warning in some use cases.

@omardelrio @ad-on-is Can you do a diagnostics report

[ad-on-is]

I tried #6652 which resulted in ln: failed to create symbolic link '/usr/bin/docker-credential-desktop.exe': File exists So the symlink seems fine.

I too can verify that docker pull works when deleting config.json.

Just upladed the diagnostics with Diagnostic ID: A7C0BC12-0C48-4ABF-BA91-359CA68AB96A/20200727093707

Additional things I tried so far without success

• Removing /usr/bin/docker-credential-desktop.exe and symlinking again
• Symlinking /usr/bin/docker-credential-wincred.exe
• chmod 777 config.json to rule out permission issues
• Logout/Login from Docker for Windows

[n10000k]

@ad-on-is try rename /usr/bin/docker-credential-desktop2.exe (adding the 2) then run the command again, what happens now?

[ad-on-is]

@ad-on-is try rename /usr/bin/docker-credential-desktop2.exe (adding the 2) then run the command again, what happens now?

Where's the difference compared to my already stated approach?

Additional things I tried so far without success

• Removing /usr/bin/docker-credential-desktop.exe and symlinking again

[n10000k]

Ah sorry my bad didn't see you removed that. I'm fairly certain you're getting symlink issues shouldn't be saying the file already exists.

[ad-on-is]

@narwy Just wanted to point out, that the file is already there. Deleting and symlinking again, worked ofc as expected.

[n10000k]

@ad-on-is after the symlink does it still hang or does pull the images?

[ad-on-is]

It still hangs.

Additional things I tried so far without success

@narwy Sorry, to sound a bit harsh, but do you even read my comments, before asking questions? I mean, each time you ask a question, it's about something I already stated. This just spams the thread unnecessarily.

[n10000k]

Deleting and symlinking again, worked ofc as expected.

Didn't really say if it fixed the hanging or if it was just the symlink fixing, so just wanted to clarify.

[ad-on-is]

Deleting and symlinking again, worked ofc as expected.

Didn't really say if it fixed the hanging or if it was just the symlink fixing, so just wanted to clarify.

Right, but #7808 (comment) clearly says everything.

[omardelrio]

@narwy

Diagnostics ID: E68C2D3E-3E2D-4A0B-B4F1-1AC619CA4445/20200727125926

[stephen-turner]

I'm not sure why @narwy is asking for diagnostics IDs as he is not a Docker employee and so won't be able to see them. It's nice that community members can help out on tickets, but they can't see the diagnostics that people send.

[n10000k]

@stephen-turner was dropping the question so when you guys had time you can look into it instead of asking them. Seen as neither was provided

[simonferquel]

I narrowed it down to interraction with the win32 credential helper.
@benhillis It is specific to Windows 10 Insider build 20175 and I think it might be a bug in the win32 binfmt handler or something related to Linux/win32 interop and stdio:

In the docker pull and docker login case, the Linux CLI ask the credential helper (with Docker Desktop, the credential helper is a win32 program) an authentication token to talk to the registry. The way it does that, is to pass a list of registry names on stdin (one line per registry name), and then closes stdin to indicate the end of the query. Then the helper returns a payload on stdout and closes.

Has something changed about this in recent builds ?

[simonferquel]

@benhillis Simple repro case on a machine with latest docker-desktop edge installed:
On Windows 10 stable: running echo test | docker-credential-desktop.exe get from Ubuntu returns credentials not found in native keychain.
On 20175, it hangs.

[nuwaverob]

i just upgraded to 20175 over the weekend and running into same issue.. the temp workaround of removing the creds does work.

[stephen-turner]

Thanks, @simonferquel. This is now microsoft/WSL#5664. I'm going to close this ticket as it's a Windows bug not a Docker Desktop bug.

[PavelSosin-320]

Microsoft broke insider release because it contains a broken Powershell 2.0 core feature. This feature was planned to be deprecated due to security reasons but still appears in /get-features list as "enabled". Such a bug breaks the Windows image completely. I already tried all receipts including removal related keys from the Windows registry, manual cleanup of winSxS folder, etc. Nothing helps. It looks like the only possibility to repair Windows image is the installation of the new image provided by Microsoft.
I never saw how Microsoft deprecates features - everything is built to last forever.

[stephen-turner]

Just for completeness, the Microsoft bug Simon filed has now been duped against microsoft/WSL#5648, so that's the one to follow now.

[carlosparamio]

Same issue here with Windows 10 20175. Removing the ~/.docker/config.json file temporarily solves it. I can also reproduce microsoft/WSL#5664.

[metcalfc]

This WSL2 bug microsoft/WSL#5664 does effect Docker, it is not an issue with Docker. We are hopeful for a fix soon. Right now Windows 20175 and 20180 have this issue. You can disable the WSL2 backend in your Docker settings for now. You won't find docker in your WSL2 path anymore but you can work around this temporarily with:

alias docker=docker.exe

Docker on the Windows side (powershell, cmd, etc) will behave normally.

[ad-on-is]

Windows 20185, problem still persists

[ad-on-is]

Fixed in Windows 10 Build 20190

[DutchKevv]

Fixed in Windows 10 Build 20190

@ad-on-is Im on the 20190 build, and docker pull still doesn't work until I delete the config.json ..

Are you sure its fixed? Did you do something else also?

[ad-on-is]

@DutchKevv

I just checked and saw I was using a clean config.json, which Docker created after I dirtyfix-deleted the old one.

Now, I restored my previous config.json which has additional repositories and all settings, and it still works.

So, technically, I did not change anything.

[docker-robott]

Closed issues are locked after 30 days of inactivity.
This helps our team focus on active issues.

If you have found a problem that seems similar to this, please open a new issue.

Send feedback to Docker Community Slack channels #docker-for-mac or #docker-for-windows.
/lifecycle locked