{{ define "install" }} {{ template "head" . }} {{ template "meta" .Meta }} {{ template "nav" . }}

Install {{ .ClientShortName }} Credential Helper

The {{ .ClientShortName }} credential helper enables Docker to authenticate with {{ .ClientShortName }} registries using your ATProto identity.

Quick Install

Using install script

curl -fsSL {{ .SiteURL }}/static/install.sh | bash

Manual download

curl -fsSLO {{ .SiteURL }}/static/install.sh
chmod +x install.sh
./install.sh

Configure Docker

After installation, configure Docker to use the credential helper:

Create or edit ~/.docker/config.json

{
  "credHelpers": {
    "{{ .RegistryURL }}": "atcr"
  }
}
{{ icon "info" "size-5" }} If you have an existing config.json, add the credHelpers entry to your existing configuration.

Authentication

The credential helper will automatically prompt for authentication when you push or pull:

docker push {{ .RegistryURL }}/yourhandle/myapp:latest

This will:

  1. Open your browser for device authorization
  2. Display a code to confirm
  3. Store credentials securely
  4. Proceed with your push/pull operation
{{ icon "check-circle" "size-5" }} Once authenticated, Docker commands work normally without any additional steps.

Alternative: Use docker login

You can also use docker login with your ATProto app password:

  1. Generate an app password at bsky.app/settings/app-passwords
  2. Run: docker login {{ .RegistryURL }}
  3. Enter your handle as username
  4. Enter your app password
{{ icon "info" "size-5" }} Create an app password at bsky.app/settings/app-passwords.

Troubleshooting

Command not found

Ensure the credential helper is in your PATH:

Check if installed
which docker-credential-atcr

                    
Add to PATH if needed

                    
export PATH="/usr/local/bin:$PATH"

                


                
Still having issues?

                
Check the full documentation or open an issue.

            


            

                
Security

                
    
                    
  • Credentials are stored in ~/.atcr/device.json with secure permissions (0600)
    • 
                    
  • Device secrets are issued per-device and can be revoked anytime
    • 
                    
  • No passwords are stored locally
    • 
                    
  • Uses ATProto OAuth with device authorization flow
    • 
                

            

        

    



    {{ template "footer" . }}


{{ end }}