"Cannot autolaunch D-Bus without X11 $DISPLAY" while running tox test on dockerfile

[zeitounator]

Issue Type

• Bug report

Molecule and Ansible details

ansible --version && molecule --version
ansible [core 2.14.0]
  config file = None
  configured module search path = ['/home/user/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /home/user/Sources/molecule/.venv/lib/python3.9/site-packages/ansible
  ansible collection location = /home/user/.ansible/collections:/usr/share/ansible/collections
  executable location = /home/user/Sources/molecule/.venv/bin/ansible
  python version = 3.9.5 (default, Nov 23 2021, 15:27:38) [GCC 9.3.0] (/home/user/Sources/molecule/.venv/bin/python)
  jinja version = 3.1.2
  libyaml = True
INFO     Found config file /home/user/Sources/molecule/.config/molecule/config.yml
molecule 4.0.4.dev28 using python 3.9 
    ansible:2.14.0
    delegated:4.0.4.dev28 from molecule
    docker:2.1.0 from molecule_docker requiring collections: community.docker>=3.0.2 ansible.posix>=1.4.0

Molecule installation method (one of):

• pip (editable inside a venv)

Ansible installation method (one of):

• pip

Detail any linters or test runners used:
tox as configured in the molecule source tree

Desired Behavior

Running tox should run all tests and succeed (as long as current branch is ok). This includes dockerfile tests

Actual Behaviour

All of the below happens by simply running tox

I have the following configuration for my docker client (i.e. only relevant part) in ~/.docker/config.json

{
        "auths": {},
        "credsStore": "secretservice"
}

This instruct docker to store the credentials in my local linux keystore whenever I issue a docker login rather than in clear text inside the json file.

For a reason I did not yet understand and although none of the relevant builds require credentials for a any docker registry while running tox dockerfile tests, all image builds fail with the following error message (abridged) regardless of the origin of their base image.

TASK [Test Dockerfile template] ***********************************************************************

An exception occurred during task execution. To see the full traceback, use -vvv. The error was: ansible_collections.community.docker.plugins.module_utils._api.credentials.errors.StoreError: Credentials store docker-credential-secretservice exited with "Cannot autolaunch D-Bus without X11 $DISPLAY".

The workaround solution is actually trivial but I have no idea at this point if it is acceptable. I could fix by just adding a line to tox.ini, i.e.:

# do not put * in passenv as it may break builds do to reduced isolation
passenv =
    DISPLAY
    [... rest of existing env in file ...]

Let me know if this would be an acceptable change and also if you want a PR for this. Else I can give any other needed information if you need more details.

[zhan9san]

Hi @zeitounator

Thanks for reporting this.

But it seems this is a feature in docker itself, which is related to https://forums.docker.com/t/docker-login-fails-with-error-message-error-saving-credentials-cannot-autolaunch-d-bus-without-x11-display/77789

This issue only occurs if you set customized credsStore, and use docker login .

Let me know if you have any question.

[zeitounator]

Maybe it was not clear enough in my description but I don't use docker login, I'm simply running tox and yet it still fails with the above error although no login is needed.

[zhan9san]

Yes, tox will run the validate-dockerfile.yml playbook and then Ansible module community.docker.docker_image.

https://github.com/ansible-community/molecule/blob/210e4b5a062e988894a4b39a2a6160a648098a6c/src/molecule/data/validate-dockerfile.yml#L36-L51

If I understand correctly, it's https://github.com/ansible-collections/community.docker/blob/90086f00ada8f403f908526352fe83296441ba8b/plugins/modules/docker_image.py#L607 and then

https://github.com/ansible-collections/community.docker/blob/90086f00ada8f403f908526352fe83296441ba8b/plugins/module_utils/_api/auth.py#L60-L62

then

https://github.com/ansible-collections/community.docker/blob/90086f00ada8f403f908526352fe83296441ba8b/plugins/module_utils/_api/auth.py#L318

then

https://github.com/ansible-collections/community.docker/blob/90086f00ada8f403f908526352fe83296441ba8b/plugins/module_utils/_api/auth.py#L220

then

https://github.com/ansible-collections/community.docker/blob/90086f00ada8f403f908526352fe83296441ba8b/plugins/module_utils/_api/auth.py#L232

Finally,
https://github.com/ansible-collections/community.docker/blob/90086f00ada8f403f908526352fe83296441ba8b/plugins/module_utils/_api/auth.py#L278

[zeitounator]

I was able to debug this a bit further.

First, I did all the below after unseting the DISPLAY variable in my environment (which seems to be the problem wherever it comes from...)

If I run the playbook manually the task completes.
If I do the same thing launching the corresponding tox environment, it fails with the same reported message

See commands and outputs below. Why would tox (or ansible.community.docker_image module running inside it) try to docker login into registries to get images which are publicly available?

$ env | grep -i display
<no result - var is unset>

$ ansible-playbook src/molecule/data/validate-dockerfile.yml 

PLAY [localhost] ***********************************************************************************************************************************************************************************************************************

TASK [Gathering Facts] *****************************************************************************************************************************************************************************************************************
ok: [localhost]

TASK [create temporary dockerfiles] ****************************************************************************************************************************************************************************************************
changed: [localhost] => (item=alpine:edge)
changed: [localhost] => (item=quay.io/centos/centos:7)
changed: [localhost] => (item=quay.io/centos/centos:stream8)
changed: [localhost] => (item=ubuntu:latest)
changed: [localhost] => (item=debian:latest)

TASK [expand Dockerfile templates] *****************************************************************************************************************************************************************************************************
changed: [localhost] => (item=alpine:edge)
changed: [localhost] => (item=quay.io/centos/centos:7)
changed: [localhost] => (item=quay.io/centos/centos:stream8)
changed: [localhost] => (item=ubuntu:latest)
changed: [localhost] => (item=debian:latest)

TASK [Test Dockerfile template] ********************************************************************************************************************************************************************************************************
changed: [localhost] => (item=alpine:edge)
changed: [localhost] => (item=quay.io/centos/centos:7)
changed: [localhost] => (item=quay.io/centos/centos:stream8)
changed: [localhost] => (item=ubuntu:latest)
changed: [localhost] => (item=debian:latest)

TASK [Clean up temporary Dockerfile's] *************************************************************************************************************************************************************************************************
changed: [localhost] => (item=/tmp/molecule-dockerfile-alpine:edgenty5d3clbuild)
changed: [localhost] => (item=/tmp/molecule-dockerfile-quay.io-centos-centos:7j8em25ezbuild)
changed: [localhost] => (item=/tmp/molecule-dockerfile-quay.io-centos-centos:stream814pwgxylbuild)
changed: [localhost] => (item=/tmp/molecule-dockerfile-ubuntu:latest1yysjzdrbuild)
changed: [localhost] => (item=/tmp/molecule-dockerfile-debian:latest1h6j4numbuild)

TASK [debug] 

     [...cut...]

$ tox -e dockerfile
dockerfile installed: ansible-core==2.13.5,certifi==2022.6.15,cffi==1.15.1,charset-normalizer==2.1.1,cryptography==37.0.4,docker==6.0.0,idna==3.3,Jinja2==3.1.2,MarkupSafe==2.1.1,packaging==21.3,pycparser==2.21,pyparsing==3.0.9,PyYAML==6.0,requests==2.28.1,resolvelib==0.8.1,urllib3==1.26.12,websocket-client==1.4.1
dockerfile run-test-pre: PYTHONHASHSEED='1843514434'
dockerfile run-test: commands[0] | ansible-galaxy collection install community.docker
Using /home/user/Sources/molecule/.ansible.cfg as config file
Starting galaxy collection install process
Nothing to do. All requested collections are already installed. If you want to reinstall them, consider using `--force`.
dockerfile run-test: commands[1] | ansible-playbook src/molecule/data/validate-dockerfile.yml
Using /home/user/Sources/molecule/.ansible.cfg as config file
[WARNING]: provided hosts list is empty, only localhost is available. Note that the implicit localhost does not match 'all'

PLAY [localhost] ***********************************************************************************************************************************************************************************************************************

TASK [Gathering Facts] *****************************************************************************************************************************************************************************************************************
ok: [localhost]

TASK [create temporary dockerfiles] ****************************************************************************************************************************************************************************************************
changed: [localhost] => (item=alpine:edge) => {"ansible_loop_var": "item", "changed": true, "gid": 100, "group": "users", "item": {"image": "alpine:edge"}, "mode": "0600", "owner": "user", "path": "/tmp/molecule-dockerfile-alpine:edgeeyfgvf98build", "size": 0, "state": "file", "uid": 1026}
changed: [localhost] => (item=quay.io/centos/centos:7) => {"ansible_loop_var": "item", "changed": true, "gid": 100, "group": "users", "item": {"image": "quay.io/centos/centos:7"}, "mode": "0600", "owner": "user", "path": "/tmp/molecule-dockerfile-quay.io-centos-centos:7ruimww2xbuild", "size": 0, "state": "file", "uid": 1026}
changed: [localhost] => (item=quay.io/centos/centos:stream8) => {"ansible_loop_var": "item", "changed": true, "gid": 100, "group": "users", "item": {"image": "quay.io/centos/centos:stream8"}, "mode": "0600", "owner": "user", "path": "/tmp/molecule-dockerfile-quay.io-centos-centos:stream85ynqy39fbuild", "size": 0, "state": "file", "uid": 1026}
changed: [localhost] => (item=ubuntu:latest) => {"ansible_loop_var": "item", "changed": true, "gid": 100, "group": "users", "item": {"image": "ubuntu:latest"}, "mode": "0600", "owner": "user", "path": "/tmp/molecule-dockerfile-ubuntu:latestt6lc_9hrbuild", "size": 0, "state": "file", "uid": 1026}
changed: [localhost] => (item=debian:latest) => {"ansible_loop_var": "item", "changed": true, "gid": 100, "group": "users", "item": {"image": "debian:latest"}, "mode": "0600", "owner": "user", "path": "/tmp/molecule-dockerfile-debian:latesteyu2kxhabuild", "size": 0, "state": "file", "uid": 1026}

TASK [expand Dockerfile templates] *****************************************************************************************************************************************************************************************************
changed: [localhost] => (item=alpine:edge) => {"ansible_index_var": "index", "ansible_loop_var": "item", "changed": true, "checksum": "ec7694254982f49351dc5faaaaa61f7fc2c2049f", "dest": "/tmp/molecule-dockerfile-alpine:edgeeyfgvf98build", "gid": 100, "group": "users", "index": 0, "item": {"image": "alpine:edge"}, "md5sum": "4ca5a9cfcb931caf37dc50a320bd6a08", "mode": "0600", "owner": "user", "size": 1035, "src": "/home/user/.ansible/tmp/ansible-tmp-1669745409.988524-1339612-201966997135773/source", "state": "file", "uid": 1026}
changed: [localhost] => (item=quay.io/centos/centos:7) => {"ansible_index_var": "index", "ansible_loop_var": "item", "changed": true, "checksum": "c0c7672a2230b829ce0fbcfd2930980bff7189a8", "dest": "/tmp/molecule-dockerfile-quay.io-centos-centos:7ruimww2xbuild", "gid": 100, "group": "users", "index": 1, "item": {"image": "quay.io/centos/centos:7"}, "md5sum": "cf398f39483fff1d7d2e934f9e654b17", "mode": "0600", "owner": "user", "size": 1047, "src": "/home/user/.ansible/tmp/ansible-tmp-1669745410.4273703-1339612-184301417014036/source", "state": "file", "uid": 1026}
changed: [localhost] => (item=quay.io/centos/centos:stream8) => {"ansible_index_var": "index", "ansible_loop_var": "item", "changed": true, "checksum": "8373660d5ea30a19ea9a83780baff45d50eff3c7", "dest": "/tmp/molecule-dockerfile-quay.io-centos-centos:stream85ynqy39fbuild", "gid": 100, "group": "users", "index": 2, "item": {"image": "quay.io/centos/centos:stream8"}, "md5sum": "5c5613d5854cad83a3dbc50aa412d13d", "mode": "0600", "owner": "user", "size": 1053, "src": "/home/user/.ansible/tmp/ansible-tmp-1669745410.6767716-1339612-12366337265579/source", "state": "file", "uid": 1026}
changed: [localhost] => (item=ubuntu:latest) => {"ansible_index_var": "index", "ansible_loop_var": "item", "changed": true, "checksum": "7f3d995f574a0ac4b5b03739c45717b42eed7d1b", "dest": "/tmp/molecule-dockerfile-ubuntu:latestt6lc_9hrbuild", "gid": 100, "group": "users", "index": 3, "item": {"image": "ubuntu:latest"}, "md5sum": "d306a73c1b5982ee5fc5c9b6cb219ed7", "mode": "0600", "owner": "user", "size": 1037, "src": "/home/user/.ansible/tmp/ansible-tmp-1669745410.934273-1339612-3624195237132/source", "state": "file", "uid": 1026}
changed: [localhost] => (item=debian:latest) => {"ansible_index_var": "index", "ansible_loop_var": "item", "changed": true, "checksum": "535f3dfd69207444ce1a2aae7c35192fc2f620b5", "dest": "/tmp/molecule-dockerfile-debian:latesteyu2kxhabuild", "gid": 100, "group": "users", "index": 4, "item": {"image": "debian:latest"}, "md5sum": "49494a1d87e7ff15b80b2a6d25e61825", "mode": "0600", "owner": "user", "size": 1037, "src": "/home/user/.ansible/tmp/ansible-tmp-1669745411.1918623-1339612-204581268099418/source", "state": "file", "uid": 1026}

TASK [Test Dockerfile template] ********************************************************************************************************************************************************************************************************
An exception occurred during task execution. To see the full traceback, use -vvv. The error was: ansible_collections.community.docker.plugins.module_utils._api.credentials.errors.StoreError: Credentials store docker-credential-secretservice exited with "Cannot autolaunch D-Bus without X11 $DISPLAY".
failed: [localhost] (item=alpine:edge) => {"ansible_loop_var": "item", "changed": false, "item": {"ansible_index_var": "index", "ansible_loop_var": "item", "changed": true, "checksum": "ec7694254982f49351dc5faaaaa61f7fc2c2049f", "dest": "/tmp/molecule-dockerfile-alpine:edgeeyfgvf98build", "diff": [], "failed": false, "gid": 100, "group": "users", "index": 0, "invocation": {"module_args": {"_original_basename": "Dockerfile.j2", "attributes": null, "backup": false, "checksum": "ec7694254982f49351dc5faaaaa61f7fc2c2049f", "content": null, "dest": "/tmp/molecule-dockerfile-alpine:edgeeyfgvf98build", "directory_mode": null, "follow": false, "force": true, "group": null, "local_follow": null, "mode": null, "owner": null, "remote_src": null, "selevel": null, "serole": null, "setype": null, "seuser": null, "src": "/home/user/.ansible/tmp/ansible-tmp-1669745409.988524-1339612-201966997135773/source", "unsafe_writes": false, "validate": null}}, "item": {"image": "alpine:edge"}, "md5sum": "4ca5a9cfcb931caf37dc50a320bd6a08", "mode": "0600", "owner": "user", "size": 1035, "src": "/home/user/.ansible/tmp/ansible-tmp-1669745409.988524-1339612-201966997135773/source", "state": "file", "uid": 1026}, "module_stderr": "Traceback (most recent call last):\n  File \"/tmp/ansible_community.docker.docker_image_payload_n9i07rsj/ansible_community.docker.docker_image_payload.zip/ansible_collections/community/docker/plugins/module_utils/_api/credentials/store.py\", line 91, in _execute\n  File \"/usr/lib/python3.9/subprocess.py\", line 424, in check_output\n    return run(*popenargs, stdout=PIPE, timeout=timeout, check=True,\n  File \"/usr/lib/python3.9/subprocess.py\", line 528, in run\n    raise CalledProcessError(retcode, process.args,\nsubprocess.CalledProcessError: Command '['/home/user/bin/docker-credential-secretservice', 'list']' returned non-zero exit status 1.\n\nDuring handling of the above exception, another exception occurred:\n\nTraceback (most recent call last):\n  File \"/home/user/.ansible/tmp/ansible-tmp-1669745411.4713504-1339812-214305643718118/AnsiballZ_docker_image.py\", line 107, in <module>\n    _ansiballz_main()\n  File \"/home/user/.ansible/tmp/ansible-tmp-1669745411.4713504-1339812-214305643718118/AnsiballZ_docker_image.py\", line 99, in _ansiballz_main\n    invoke_module(zipped_mod, temp_path, ANSIBALLZ_PARAMS)\n  File \"/home/user/.ansible/tmp/ansible-tmp-1669745411.4713504-1339812-214305643718118/AnsiballZ_docker_image.py\", line 47, in invoke_module\n    runpy.run_module(mod_name='ansible_collections.community.docker.plugins.modules.docker_image', init_globals=dict(_module_fqn='ansible_collections.community.docker.plugins.modules.docker_image', _modlib_path=modlib_path),\n  File \"/usr/lib/python3.9/runpy.py\", line 210, in run_module\n    return _run_module_code(code, init_globals, run_name, mod_spec)\n  File \"/usr/lib/python3.9/runpy.py\", line 97, in _run_module_code\n    _run_code(code, mod_globals, init_globals,\n  File \"/usr/lib/python3.9/runpy.py\", line 87, in _run_code\n    exec(code, run_globals)\n  File \"/tmp/ansible_community.docker.docker_image_payload_n9i07rsj/ansible_community.docker.docker_image_payload.zip/ansible_collections/community/docker/plugins/modules/docker_image.py\", line 965, in <module>\n  File \"/tmp/ansible_community.docker.docker_image_payload_n9i07rsj/ansible_community.docker.docker_image_payload.zip/ansible_collections/community/docker/plugins/modules/docker_image.py\", line 954, in main\n  File \"/tmp/ansible_community.docker.docker_image_payload_n9i07rsj/ansible_community.docker.docker_image_payload.zip/ansible_collections/community/docker/plugins/modules/docker_image.py\", line 419, in __init__\n  File \"/tmp/ansible_community.docker.docker_image_payload_n9i07rsj/ansible_community.docker.docker_image_payload.zip/ansible_collections/community/docker/plugins/modules/docker_image.py\", line 453, in present\n  File \"/tmp/ansible_community.docker.docker_image_payload_n9i07rsj/ansible_community.docker.docker_image_payload.zip/ansible_collections/community/docker/plugins/modules/docker_image.py\", line 763, in build_image\n  File \"/tmp/ansible_community.docker.docker_image_payload_n9i07rsj/ansible_community.docker.docker_image_payload.zip/ansible_collections/community/docker/plugins/module_utils/_api/api/client.py\", line 509, in _set_auth_headers\n  File \"/tmp/ansible_community.docker.docker_image_payload_n9i07rsj/ansible_community.docker.docker_image_payload.zip/ansible_collections/community/docker/plugins/module_utils/_api/auth.py\", line 299, in get_all_credentials\n  File \"/tmp/ansible_community.docker.docker_image_payload_n9i07rsj/ansible_community.docker.docker_image_payload.zip/ansible_collections/community/docker/plugins/module_utils/_api/credentials/store.py\", line 83, in list\n  File \"/tmp/ansible_community.docker.docker_image_payload_n9i07rsj/ansible_community.docker.docker_image_payload.zip/ansible_collections/community/docker/plugins/module_utils/_api/credentials/store.py\", line 105, in _execute\nansible_collections.community.docker.plugins.module_utils._api.credentials.errors.StoreError: Credentials store docker-credential-secretservice exited with \"Cannot autolaunch D-Bus without X11 $DISPLAY\".\n", "module_stdout": "", "msg": "MODULE FAILURE\nSee stdout/stderr for the exact error", "rc": 1}

[.... cut ...]

[zhan9san]

The workaround solution is actually trivial but I have no idea at this point if it is acceptable. I could fix by just adding a line to tox.ini, i.e.:

# do not put * in passenv as it may break builds do to reduced isolation
passenv =
    DISPLAY
    [... rest of existing env in file ...]

A PR is welcomed and acceptable.

The DISPLAY environment variable is required if docker-credential-secretservice is invoked somewhere.

[zeitounator]

A PR is welcomed and acceptable.

@zhan9san Done in #3764. Thanks !