docker: adjust how CLI is loaded (#6191)

some bits of the load sequence changes in Docker 24

Fixes #6189

Signed-off-by: Nick Santos <[email protected]>

integration/env_test.go

@@ -0,0 +1,25 @@
+//go:build integration
+// +build integration
+
+package integration
+
+import (
+	"bytes"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+// The Docker CLI library loads all env variables on it.
+// So the only way to really test if we're loading them properly
+// is to run tilt.
+func TestEnvInit(t *testing.T) {
+	t.Setenv("DOCKER_TLS_VERIFY", "1")
+	t.Setenv("DOCKER_CERT_PATH", "/tmp/unused-path")
+
+	f := newK8sFixture(t, "oneup")
+	out := &bytes.Buffer{}
+	err := f.tilt.CI(f.ctx, out)
+	assert.Error(t, err)
+	assert.Contains(t, out.String(), "unable to resolve docker endpoint: open /tmp/unused-path/ca.pem")
+}

internal/docker/client.go

@@ -14,7 +14,6 @@ import (
 	"github.com/blang/semver"
 	"github.com/docker/cli/cli/command"
 	"github.com/docker/cli/cli/config"
-	cliflags "github.com/docker/cli/cli/flags"
 	"github.com/docker/distribution/reference"
 	"github.com/docker/docker/api/types"
 	mobycontainer "github.com/docker/docker/api/types/container"
@@ -389,18 +388,9 @@ func (c *Cli) ServerVersion() types.Version {
 type encodedAuth string
 
 func (c *Cli) authInfo(ctx context.Context, repoInfo *registry.RepositoryInfo, cmdName string) (encodedAuth, types.RequestPrivilegeFunc, error) {
-	infoWriter := logger.Get(ctx).Writer(logger.InfoLvl)
-	cli, err := command.NewDockerCli(
-		command.WithCombinedStreams(infoWriter),
-		command.WithContentTrust(true),
-	)
-	if err != nil {
-		return "", nil, errors.Wrap(err, "authInfo#NewDockerCli")
-	}
-
-	err = cli.Initialize(cliflags.NewClientOptions())
+	cli, err := newDockerCli(ctx)
 	if err != nil {
-		return "", nil, errors.Wrap(err, "authInfo#InitializeCLI")
+		return "", nil, errors.Wrap(err, "authInfo")
 	}
 	authConfig := command.ResolveAuthConfig(ctx, cli, repoInfo.Index)
 	requestPrivilege := command.RegistryAuthenticationPrivilegedFunc(cli, repoInfo.Index, cmdName)

internal/docker/env.go

@@ -14,6 +14,7 @@ import (
 	"github.com/docker/cli/opts"
 	"github.com/docker/docker/client"
 	"github.com/pkg/errors"
+	"github.com/spf13/pflag"
 
 	"github.com/tilt-dev/clusterid"
 
@@ -105,24 +106,44 @@ func (RealClientCreator) FromEnvMap(envMap map[string]string) (DaemonClient, err
 }
 
 func (RealClientCreator) FromCLI(ctx context.Context) (DaemonClient, error) {
+	cli, err := newDockerCli(ctx)
+	if err != nil {
+		return nil, err
+	}
+
+	client, ok := cli.Client().(*client.Client)
+	if !ok {
+		return nil, fmt.Errorf("unexpected docker client: %T", cli.Client())
+	}
+	return client, nil
+}
+
+// Creating a DockerCli is really the only way to get a DOCKER_CONTEXT-aware
+// docker client.
+func newDockerCli(ctx context.Context) (*command.DockerCli, error) {
 	out := logger.Get(ctx).Writer(logger.InfoLvl)
 	dockerCli, err := command.NewDockerCli(
-		command.WithOutputStream(out),
-		command.WithErrorStream(out))
+		command.WithCombinedStreams(out))
 	if err != nil {
 		return nil, fmt.Errorf("creating docker client: %v", err)
 	}
 
 	opts := cliflags.NewClientOptions()
+	flagSet := pflag.NewFlagSet("docker", pflag.ContinueOnError)
+	opts.InstallFlags(flagSet)
+	opts.SetDefaultOptions(flagSet)
 	err = dockerCli.Initialize(opts)
 	if err != nil {
 		return nil, fmt.Errorf("initializing docker client: %v", err)
 	}
-	client, ok := dockerCli.Client().(*client.Client)
-	if !ok {
-		return nil, fmt.Errorf("unexpected docker client: %T", dockerCli.Client())
+
+	// A hack to see if initialization failed.
+	// https://github.com/docker/cli/issues/4489
+	endpoint := dockerCli.DockerEndpoint()
+	if endpoint.Host == "" {
+		return nil, fmt.Errorf("initializing docker client: no valid endpoint")
 	}
-	return client, nil
+	return dockerCli, nil
 }
 
 // Tell wire to create two docker envs: one for the local CLI and one for the in-cluster CLI.