Docker hub credentials not used

[pauldtill]

How are you running Renovate?

Self-hosted Renovate

If you're self-hosting Renovate, tell us which platform (GitHub, GitLab, etc) and which version of Renovate.

GitLab
39.72.2

Please tell us more about your question or problem

We have the following HostRules defined providing credentials for docker hub, but still seeing issues with rate limiting and in the error log (below) it implies our username and password are not being set in the call.

We added docker.com as well as docker.io as the failing call appears to be to hub.docker.com - but still shows the same.

What are we missing ?

  hostRules: [
    {
      hostType: 'docker',
      username: process.env.INTERNAL_REGISTRY_USER,
      password: process.env.INTERNAL_REGISTRY_PASSWORD,
      matchHost: 'https://internal-registry.com',
    },
    {
      hostType: 'docker',
      username: process.env.DOCKER_HUB_USERNAME,
      password: process.env.DOCKER_HUB_PASSWORD,
      matchHost: 'docker.io',
    },
    {
      hostType: 'docker',
      username: process.env.DOCKER_HUB_USERNAME,
      password: process.env.DOCKER_HUB_PASSWORD,
      matchHost: 'docker.com',
    }
  ]

Logs (if relevant)

Logs

        "message": "Response code 429 (Too Many Requests)",
         "stack": "HTTPError: Response code 429 (Too Many Requests)\n    at Request.<anonymous> (/usr/local/renovate/node_modules/.pnpm/got@11.8.6/node_modules/got/dist/source/as-promise/index.js:118:42)\n    at processTicksAndRejections (node:internal/process/task_queues:105:5)",
         "options": {
           "headers": {
             "user-agent": "RenovateBot/39.62.5 (https://github.com/renovatebot/renovate)",
             "accept": "application/json",
             "authorization": "***********",
             "accept-encoding": "gzip, deflate, br"
           },
           "url": "https://hub.docker.com/v2/repositories/gitlab/gitlab-runner-helper/tags?ordering=last_updated&page=227&page_size=100",
           "hostType": "docker",
           "username": "",
           "password": "",
           "method": "GET",
           "http2": false
         },

[rarkins]

Try hardcoding dummy username and password as strings to see if they get used/attempted. There could be a problem with env

[pauldtill]

I did this and yes I then see 401 errors. It's odd because I see the 429 "rate limit" but then am still getting results, does the process try multiple source URL's for docker hub ? After the 429 error, I then see this >

DEBUG: Using queue: host=index.docker.io, concurrency=16 (repository=masglobaldevops/gitlab-cicd-shared/docker/gitlab-runner-helper, baseBranch=main)

results are then printed for the dependency.

The error message itself still shows empty string for username/password which is misleading.

[rarkins]

It might be falling back to docker.io if docker.com fails