Does act support the container attribute?

[thirtytwobits]

I'm trying to use act for the first time but we run all of our project's actions in our own containers hosted on ghcr (publicly). e.g.:

jobs:
  verification:
    runs-on: ubuntu-latest
    container: ghcr.io/opencyphal/toolshed:ts22.4.3
    strategy:
...

Does act actually support this? I can't find any documentation about it and it just fails when I try with:

[libcyphal_test/verification-2] 🚀  Start image=ghcr.io/opencyphal/toolshed:ts22.4.3
...
[libcyphal_test/verification-2]   🐳  docker pull image=ghcr.io/opencyphal/toolshed:ts22.4.3 platform= username= forcePull=true
...
[libcyphal_test/verification-3] using DockerAuthConfig authentication for docker pull
Error: Error response from daemon: Head "https://ghcr.io/v2/opencyphal/toolshed/manifests/ts22.4.3": denied: denied

Again, these containers are fully public so no authorization is needed.

Anyway, just wanted to be sure I wasn't wasting my time trying to get something to work that isn't supported. Any documentation on this would be appreciated.

[thirtytwobits]

Looks like this is cause by #1165 ? So, assuming the container property is supposed to work, it's just broken right now?

[thirtytwobits]

Confirmed that I'm running the version with #1774 so that doesn't seem to fix the issue on mac.

[thirtytwobits]

So, yes! Act does appear to support container (it'd be nice if your docs were a bit more robust in listing things like what is supported and what is not). My problem was that act was trying to use some stuck credentials for ghcr I had and was not falling back to unauthenticated pull. So #1774 does not seem to be fixed. The logging around this needs to be improved as well since it displayed a blank user name in the output but did not otherwise indicate that it was actually trying to use credentials to log in.

For the record, I did docker-credential-desktop list and saw the invalid credentials. I then had to do docker logout ghcr.io since docker logout just tries to logout of dockerhub. That seems to work around the issue but I had to just try shit to figure this out. There needs to be better logging in place to help users understand what's going wrong.

Ideally you'd just add a flag like --container-no-auth to force the issue.

[ChristopherHX]

PR #1774 doesn't retry on error "denied", it only retries on error "unauthenticated".

There needs to be better logging in place to help users understand what's going wrong.

Any example what would be better logging? log username? logging the password is not an option.

[thirtytwobits]

user name would be enough. Something like "failed to authenticate using credential for user {username}. Use --container-no-auth to try without authentication."