From 9cd14670adb715ca1b1450af90dc5f843fae11a5 Mon Sep 17 00:00:00 2001 From: Maximilian Bosch Date: Fri, 25 Apr 2025 15:39:00 +0200 Subject: [PATCH] nixos/oci-containers: escape `login.username` When using e.g. GitLab as container registry, the token name may be the username. However, the token name can contain special characters including spaces breaking the registry login like this: Apr 25 15:35:48 test42 pre-start[294091]: image doesn't exist locally and login failed Apr 25 15:35:52 test42 pre-start[294289]: Error: accepts at most 1 arg(s), received 2 Apr 25 15:35:52 test42 pre-start[294297]: Error: registry.example.com/foo/bar/baz: image not known Applying `escapeShellArg` on it fixes the problem. --- nixos/modules/virtualisation/oci-containers.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nixos/modules/virtualisation/oci-containers.nix b/nixos/modules/virtualisation/oci-containers.nix index d81246e31383..db7f9dd29ce0 100644 --- a/nixos/modules/virtualisation/oci-containers.nix +++ b/nixos/modules/virtualisation/oci-containers.nix @@ -416,7 +416,7 @@ let # try logging in, if it fails, check if image exists locally ${cfg.backend} login \ ${container.login.registry} \ - --username ${container.login.username} \ + --username ${escapeShellArg container.login.username} \ --password-stdin < ${container.login.passwordFile} \ || ${cfg.backend} image inspect ${container.image} >/dev/null \ || { echo "image doesn't exist locally and login failed" >&2 ; exit 1; }