test(registry): add private-registry auto-login integration test

Author: Tranquility2

modules/registry/tests/test_registry.py

@@ -1,7 +1,14 @@
+import base64
+import json
+
+import pytest
 from requests import Response, get
 from requests.auth import HTTPBasicAuth
-from testcontainers.registry import DockerRegistryContainer
 
+from testcontainers.core.config import testcontainers_config
+from testcontainers.core.docker_client import DockerClient
+from testcontainers.core.utils import is_mac
+from testcontainers.registry import DockerRegistryContainer
 
 REGISTRY_USERNAME: str = "foo"
 REGISTRY_PASSWORD: str = "bar"
@@ -25,3 +32,56 @@ def test_registry_with_authentication() -> None:
         response: Response = get(url, auth=HTTPBasicAuth(REGISTRY_USERNAME, REGISTRY_PASSWORD))
 
         assert response.status_code == 200
+
+
+@pytest.mark.skipif(
+    is_mac(),
+    reason="Docker Desktop on macOS does not support insecure private registries without daemon reconfiguration",
+)
+def test_registry_login(monkeypatch) -> None:
+    """DockerClient auto-logs-in via DOCKER_AUTH_CONFIG, proven by pulling a private image.
+
+    Works against remote (SSH) Docker hosts too: the registry is addressed via
+    ``127.0.0.1:<published_port>``, which the daemon treats as insecure-by-default
+    (the ``127.0.0.0/8`` range), so the login/push/pull happen over plain HTTP
+    without reconfiguring the daemon's ``insecure-registries``.
+    """
+    image: str = "hello-world"
+    tag: str = "latest"
+
+    with DockerRegistryContainer(username=REGISTRY_USERNAME, password=REGISTRY_PASSWORD) as registry_container:
+        # Address the registry over the daemon's loopback (works for both local
+        # and remote/SSH daemons) so HTTP is allowed without insecure-registries.
+        port: str = registry_container.get_exposed_port(registry_container.port)
+        registry_url: str = f"127.0.0.1:{port}"
+        private_ref: str = f"{registry_url}/{image}:{tag}"
+
+        creds: str = base64.b64encode(f"{REGISTRY_USERNAME}:{REGISTRY_PASSWORD}".encode()).decode()
+        auth_config: str = json.dumps({"auths": {registry_url: {"auth": creds}}})
+
+        # Seed the private registry with an image (push authenticated explicitly),
+        # then drop the local tag so the later pull must hit the registry. Reuse
+        # the container's own client (it sets ``use_ssh_client`` for SSH hosts,
+        # avoiding paramiko's stdin clash with pytest output capture).
+        seed_client = registry_container.get_docker_client().client
+        seed_image = seed_client.images.pull(image, tag=tag)
+        seed_image.tag(f"{registry_url}/{image}", tag=tag)
+        seed_client.images.push(
+            f"{registry_url}/{image}",
+            tag=tag,
+            auth_config={"username": REGISTRY_USERNAME, "password": REGISTRY_PASSWORD},
+        )
+        seed_client.images.remove(private_ref)
+
+        # DockerClient.__init__ logs in using the auth config below. Pulling the
+        # private image without explicit credentials only succeeds if that
+        # auto-login actually happened, so this exercises testcontainers' wiring
+        # rather than docker-py's login() directly.
+        monkeypatch.setattr(testcontainers_config, "docker_auth_config", auth_config)
+        client = DockerClient()
+        try:
+            pulled = client.client.images.pull(private_ref)
+            assert pulled is not None
+        finally:
+            client.client.images.remove(private_ref)
+            client.client.close()