feat: ECR credential integration into Finch

Makefile

@@ -29,7 +29,7 @@ LDFLAGS := "-X $(PACKAGE)/pkg/version.Version=$(VERSION) -X $(PACKAGE)/pkg/versi
 .DEFAULT_GOAL := all
 
 INSTALLED ?= false
-
+REGISTRY ?= ""
 ifneq (,$(findstring arm64,$(ARCH)))
 	SUPPORTED_ARCH = true
 	LIMA_ARCH = aarch64
@@ -273,7 +273,7 @@ test-e2e-container:
 
 .PHONY: test-e2e-vm
 test-e2e-vm:
-	go test -ldflags $(LDFLAGS) -timeout 45m ./e2e/vm -test.v -ginkgo.v --installed="$(INSTALLED)"
+	go test -ldflags $(LDFLAGS) -timeout 45m ./e2e/vm -test.v -ginkgo.v --installed="$(INSTALLED)" --registry="$(REGISTRY)"
 
 .PHONY: test-benchmark
 test-benchmark:

README.md

@@ -99,6 +99,8 @@ An example `finch.yaml` looks like this:
 cpus: 4
 # Memory: the amount of memory to dedicate to the virtual machine. (required)
 memory: 4GiB
+# CredsHelper: the credential helper that will be installed and configured automatically on vm init or on vm start 
+credsHelper: ecr-login
 # AdditionalDirectories: the work directories that are not supported by default. In macOS, only home directory is supported by default. 
 # For example, if you want to mount a directory into a container, and that directory is not under your home directory, 
 # then you'll need to specify this field to add that directory or any ascendant of it as a work directory. (optional)

cmd/finch/main.go

@@ -15,6 +15,7 @@ import (
 	"github.com/runfinch/finch/pkg/command"
 	"github.com/runfinch/finch/pkg/config"
 	"github.com/runfinch/finch/pkg/dependency"
+	"github.com/runfinch/finch/pkg/dependency/credhelper"
 	"github.com/runfinch/finch/pkg/dependency/vmnet"
 	"github.com/runfinch/finch/pkg/disk"
 	"github.com/runfinch/finch/pkg/flog"
@@ -120,7 +121,11 @@ func virtualMachineCommands(
 	fs afero.Fs,
 	fc *config.Finch,
 ) *cobra.Command {
-	optionalDepGroups := []*dependency.Group{vmnet.NewDependencyGroup(ecc, lcc, fs, fp, logger)}
+	optionalDepGroups := []*dependency.Group{
+		vmnet.NewDependencyGroup(ecc, lcc, fs, fp, logger),
+		credhelper.NewDependencyGroup(ecc, fs, fp, logger, fc, system.NewStdLib().Env("USER"),
+			system.NewStdLib().Arch()),
+	}
 	return newVirtualMachineCommand(
 		lcc,
 		logger,

e2e/e2e.go

@@ -39,7 +39,11 @@ import (
 const InstalledTestSubject = "finch"
 
 // Installed indicates whether the tests are run against installed application.
-var Installed = flag.Bool("installed", false, "the flag to show whether the tests are run against installed application")
+// Registry indicates which container registry to pull from.
+var (
+	Installed = flag.Bool("installed", false, "the flag to show whether the tests are run against installed application")
+	Registry  = flag.String("registry", "", "used when pulling from registry to test credential helper")
+)
 
 // CreateOption creates an option for running e2e tests.
 func CreateOption() (*option.Option, error) {

e2e/vm/cred_helper_test.go

@@ -0,0 +1,29 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+package vm
+
+import (
+	"github.com/onsi/ginkgo/v2"
+	"github.com/onsi/gomega"
+	"github.com/onsi/gomega/gexec"
+	"github.com/runfinch/common-tests/command"
+	"github.com/runfinch/common-tests/option"
+)
+
+var testCredHelper = func(o *option.Option, installed bool, registry string) {
+	ginkgo.Describe("Credential Helper", func() {
+		ginkgo.It("should pull from container registry", func() {
+			resetVM(o, installed)
+			resetDisks(o, installed)
+			if registry == "" {
+				ginkgo.Skip("No Provided Container Registry Url")
+			}
+			writeFile(finchConfigFilePath, []byte("memory: 4GiB\ncredsHelper: ecr-login\ncpus: 6\nvmType: vz\nrosetta: false"))
+			initCmdSession := command.New(o, virtualMachineRootCmd, "init").WithTimeoutInSeconds(600).Run()
+			gomega.Expect(initCmdSession).Should(gexec.Exit(0))
+			command.New(o, "pull", registry).WithTimeoutInSeconds(600).Run()
+			gomega.Expect(command.Stdout(o, "images", "-q", registry)).NotTo(gomega.BeEmpty())
+		})
+	})
+}

e2e/vm/vm_test.go

@@ -52,6 +52,7 @@ func TestVM(t *testing.T) {
 		testVersion(o)
 		testVirtualizationFrameworkAndRosetta(o, *e2e.Installed)
 		testSupportBundle(o)
+		testCredHelper(o, *e2e.Installed, *e2e.Registry)
 	})
 
 	gomega.RegisterFailHandler(ginkgo.Fail)

go.mod

@@ -3,6 +3,7 @@ module github.com/runfinch/finch
 go 1.20
 
 require (
+	github.com/docker/cli v24.0.4+incompatible
 	github.com/docker/docker v24.0.2+incompatible
 	github.com/golang/mock v1.6.0
 	github.com/google/go-licenses v1.6.0
@@ -26,6 +27,7 @@ require (
 
 require (
 	github.com/containerd/containerd v1.7.1 // indirect
+	github.com/docker/docker-credential-helpers v0.7.0 // indirect
 	github.com/docker/go-connections v0.4.0 // indirect
 	github.com/go-ole/go-ole v1.2.6 // indirect
 	github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572 // indirect
@@ -63,7 +65,7 @@ require (
 	github.com/mattn/go-colorable v0.1.13 // indirect
 	github.com/mattn/go-isatty v0.0.19 // indirect
 	github.com/mitchellh/go-homedir v1.1.0 // indirect
-	github.com/opencontainers/go-digest v1.0.0 // indirect
+	github.com/opencontainers/go-digest v1.0.0
 	github.com/otiai10/copy v1.6.0 // indirect
 	github.com/pbnjay/memory v0.0.0-20210728143218-7b4eea64cf58
 	github.com/pmezard/go-difflib v1.0.0 // indirect

go.sum

@@ -94,8 +94,12 @@ github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ3
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/docker/cli v24.0.4+incompatible h1:Y3bYF9ekNTm2VFz5U/0BlMdJy73D+Y1iAAZ8l63Ydzw=
+github.com/docker/cli v24.0.4+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
 github.com/docker/docker v24.0.2+incompatible h1:eATx+oLz9WdNVkQrr0qjQ8HvRJ4bOOxfzEo8R+dA3cg=
 github.com/docker/docker v24.0.2+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
+github.com/docker/docker-credential-helpers v0.7.0 h1:xtCHsjxogADNZcdv1pKUHXryefjlVRqWqIhk/uXJp0A=
+github.com/docker/docker-credential-helpers v0.7.0/go.mod h1:rETQfLdHNT3foU5kuNkFR1R1V12OJRRO5lzt2D1b5X0=
 github.com/docker/go-connections v0.4.0 h1:El9xVISelRB7BuFusrZozjnkIM5YnzCViNKohAFqRJQ=
 github.com/docker/go-connections v0.4.0/go.mod h1:Gbd7IOopHjR8Iph03tsViu4nIes5XhDvyHbTtUxmeec=
 github.com/docker/go-units v0.5.0 h1:69rxXcBk27SvSaaxTtLh/8llcHD8vYHT7WSdRZ/jvr4=

pkg/config/config.go

@@ -33,8 +33,9 @@ type AdditionalDirectory struct {
 
 // Finch represents the configuration file for Finch CLI.
 type Finch struct {
-	CPUs   *int    `yaml:"cpus"`
-	Memory *string `yaml:"memory"`
+	CPUs        *int    `yaml:"cpus"`
+	Memory      *string `yaml:"memory"`
+	CredsHelper *string `yaml:"credsHelper,omitempty"`
 	// AdditionalDirectories are the work directories that are not supported by default. In macOS, only home directory is supported by default.
 	// For example, if you want to mount a directory into a container, and that directory is not under your home directory,
 	// then you'll need to specify this field to add that directory or any ascendant of it as a work directory.

pkg/config/nerdctl_config_applier.go

@@ -42,6 +42,17 @@ func NewNerdctlApplier(dialer fssh.Dialer, fs afero.Fs, privateKeyPath, hostUser
 	}
 }
 
+func addLinetoFilePath(fs afero.Fs, profileFilePath string, profStr string, cmd string) (string, error) {
+	if !strings.Contains(profStr, cmd) {
+		profBufWithCmd := fmt.Sprintf("%s\n%s", profStr, cmd)
+		if err := afero.WriteFile(fs, profileFilePath, []byte(profBufWithCmd), 0o644); err != nil {
+			return "", fmt.Errorf("failed to write to profile file: %w", err)
+		}
+		return profBufWithCmd, nil
+	}
+	return profStr, nil
+}
+
 // updateEnvironment adds variables to the user's shell's environment. Currently it uses ~/.bashrc because
 // Bash is the default shell and Bash will not load ~/.profile if ~/.bash_profile exists (which it does).
 // ~/.bash_profile sources ~/.bashrc, so ~/.bashrc is currently the best place to define additional variables.
@@ -56,18 +67,25 @@ func NewNerdctlApplier(dialer fssh.Dialer, fs afero.Fs, privateKeyPath, hostUser
 // [GNU docs for Bash]: https://www.gnu.org/software/bash/manual/html_node/Bash-Startup-Files.html
 //
 // [registry nerdctl docs]: https://github.com/containerd/nerdctl/blob/master/docs/registry.md
+
 func updateEnvironment(fs afero.Fs, user string) error {
+	cmdArr := [4]string{
+		fmt.Sprintf("export DOCKER_CONFIG=\"/Users/%s/.finch\"", user),
+		fmt.Sprintf("[ -L /usr/local/bin/docker-credential-ecr-login ] "+
+			"|| sudo ln -s /Users/%s/.finch/cred-helpers/docker-credential-ecr-login /usr/local/bin/", user),
+		fmt.Sprintf("[ -L /root/.aws ] || sudo ln -fs  /Users/%s/.aws /root/.aws", user),
+	}
+
 	profileFilePath := fmt.Sprintf("/home/%s.linux/.bashrc", user)
 	profBuf, err := afero.ReadFile(fs, profileFilePath)
 	if err != nil {
 		return fmt.Errorf("failed to read config file: %w", err)
 	}
-
 	profStr := string(profBuf)
-	if !strings.Contains(profStr, "export DOCKER_CONFIG") {
-		profBufWithDockerCfg := fmt.Sprintf("%s\nexport DOCKER_CONFIG=\"/Users/%s/.finch\"\n", profStr, user)
-		if err := afero.WriteFile(fs, profileFilePath, []byte(profBufWithDockerCfg), 0o644); err != nil {
-			return fmt.Errorf("failed to write to profile file: %w", err)
+	for _, element := range cmdArr {
+		profStr, err = addLinetoFilePath(fs, profileFilePath, profStr, element)
+		if err != nil {
+			return err
 		}
 	}
 

pkg/config/nerdctl_config_applier_test.go

@@ -47,7 +47,11 @@ func Test_updateEnvironment(t *testing.T) {
 			postRunCheck: func(t *testing.T, fs afero.Fs) {
 				fileBytes, err := afero.ReadFile(fs, "/home/mock_user.linux/.bashrc")
 				require.NoError(t, err)
-				assert.Equal(t, []byte("\n"+`export DOCKER_CONFIG="/Users/mock_user/.finch"`+"\n"), fileBytes)
+				assert.Equal(t,
+					[]byte("\nexport DOCKER_CONFIG=\"/Users/mock_user/.finch\""+
+						"\n[ -L /usr/local/bin/docker-credential-ecr-login ] || sudo ln -s "+
+						"/Users/mock_user/.finch/cred-helpers/docker-credential-ecr-login /usr/local/bin/"+
+						"\n"+"[ -L /root/.aws ] || sudo ln -fs  /Users/mock_user/.aws /root/.aws"), fileBytes)
 			},
 			want: nil,
 		},
@@ -60,15 +64,20 @@ func Test_updateEnvironment(t *testing.T) {
 					afero.WriteFile(
 						fs,
 						"/home/mock_user.linux/.bashrc",
-						[]byte(`export DOCKER_CONFIG="/Users/mock_user/.finch"`),
+						[]byte("export DOCKER_CONFIG=\"/Users/mock_user/.finch\""+"\n"+"[ -L /usr/local/bin/docker-credential-ecr-login ] "+
+							"|| sudo ln -s /Users/mock_user/.finch/cred-helpers/docker-credential-ecr-login /usr/local/bin/"+
+							"\n"+"[ -L /root/.aws ] || sudo ln -fs  /Users/mock_user/.aws /root/.aws"),
 						0o644,
 					),
 				)
 			},
 			postRunCheck: func(t *testing.T, fs afero.Fs) {
 				fileBytes, err := afero.ReadFile(fs, "/home/mock_user.linux/.bashrc")
 				require.NoError(t, err)
-				assert.Equal(t, []byte(`export DOCKER_CONFIG="/Users/mock_user/.finch"`), fileBytes)
+				assert.Equal(t, []byte(`export DOCKER_CONFIG="/Users/mock_user/.finch"`+"\n"+
+					"[ -L /usr/local/bin/docker-credential-ecr-login ] "+
+					"|| sudo ln -s /Users/mock_user/.finch/cred-helpers/docker-credential-ecr-login /usr/local/bin/"+
+					"\n"+"[ -L /root/.aws ] || sudo ln -fs  /Users/mock_user/.aws /root/.aws"), fileBytes)
 			},
 			want: nil,
 		},

pkg/dependency/credhelper/cred_helper.go

@@ -0,0 +1,70 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+// Package credhelper for integrating credential helpers into Finch
+package credhelper
+
+import (
+	"fmt"
+
+	"github.com/spf13/afero"
+
+	"github.com/runfinch/finch/pkg/command"
+	"github.com/runfinch/finch/pkg/config"
+	"github.com/runfinch/finch/pkg/dependency"
+	"github.com/runfinch/finch/pkg/flog"
+	"github.com/runfinch/finch/pkg/path"
+)
+
+const (
+	description = "Installing Credential Helper"
+	errMsg      = "Failed to finish installing credential helper"
+)
+
+// NewDependencyGroup returns a dependency group that contains all the dependencies required to make credhelper work.
+func NewDependencyGroup(
+	execCmdCreator command.Creator,
+	fs afero.Fs,
+	fp path.Finch,
+	logger flog.Logger,
+	fc *config.Finch,
+	user string,
+	arch string,
+) *dependency.Group {
+	deps := newDeps(execCmdCreator, fs, fp, logger, fc, user, arch)
+	return dependency.NewGroup(deps, description, errMsg)
+}
+
+type helperConfig struct {
+	binaryName    string
+	credHelperURL string
+	hash          string
+	installFolder string
+	finchPath     string
+}
+
+func newDeps(
+	execCmdCreator command.Creator,
+	fs afero.Fs,
+	fp path.Finch,
+	logger flog.Logger,
+	fc *config.Finch,
+	user string,
+	arch string,
+) []dependency.Dependency {
+	var deps []dependency.Dependency
+
+	credHelperURL := fmt.Sprintf("https://amazon-ecr-credential-helper-releases.s3.us-east-2.amazonaws.com"+
+		"/0.7.0/linux-%s/docker-credential-ecr-login", arch)
+	installFolder := fmt.Sprintf("/Users/%s/.finch/cred-helpers/", user)
+	finchPath := fmt.Sprintf("/Users/%s/.finch/", user)
+	hc := helperConfig{
+		binaryName: "docker-credential-ecr-login", credHelperURL: credHelperURL,
+		hash: "sha256:ff14a4da40d28a2d2d81a12a7c9c36294ddf8e6439780c4ccbc96622991f3714", installFolder: installFolder,
+		finchPath: finchPath,
+	}
+	binaries := newCredHelperBinary(fp, fs, execCmdCreator, logger, fc, user, hc)
+	deps = append(deps, dependency.Dependency(binaries))
+
+	return deps
+}