Mask credentials from stderr for failed Docker logins for local mode

[jmahlik]

Describe the bug
A clear and concise description of what the bug is.
Currently uses -p flag to pass credentials. This can result in creds being leaked. Change how docker login is handled or pipe the std err and raise manually on failure.

See conversation in #2146.

To reproduce
A clear, step-by-step set of instructions to reproduce the bug.
See PR, failed docker login = logs have leaked creds.

Expected behavior
A clear and concise description of what you expected to happen.

Screenshots or logs
If applicable, add screenshots or logs to help explain your problem.

System information
A description of your system. Please provide:

• SageMaker Python SDK version:
• Framework name (eg. PyTorch) or algorithm (eg. KMeans):
• Framework version:
• Python version:
• CPU or GPU:
• Custom Docker image (Y/N):

Additional context
Add any other context about the problem here.

[ahsan-z-khan]

Hi @jmahlik ,

What would be the expected behavior on this?

[jmahlik]

Hi @jmahlik ,

What would be the expected behavior on this?

Currently it uses check_output. If the login fails for some reason, like no access, mistyped image, repo etc, the password gets dumped to stdout unaltered. So creds will be show in plain text.

    cmd = "docker login -u AWS -p %s %s" % (token, ecr_url)
    subprocess.check_output(cmd.split())

To avoid the creds getting leaked, it should pass the password via stdin. Something like below should work.

        cmd = [
            "docker",
            "login",
            ecr_url,
            "-u",
            "AWS"
            "--password-stdin",
        ]
        proc = subprocess.Popen(
            cmd,
            stdin=subprocess.PIPE,
        )

        stdout, stderr = proc.communicate(input=token.encode())

        # I don't think the replacing below is necessary, since docker won't leak the creds with this login method
        # But, just in case, possibly need to replace the token with * in the output
        logger.info("%s, %s", stdout.decode().replace(token, "***"), stderr.decode().replace(token, "***"))