How to know if docker is already logged in to a docker registry server

You can do the following command to see the username you are logged in with and the registry used:

docker system info | grep -E 'Username|Registry'

The answers here so far are not so useful:

• docker info no longer provides this info
• docker logout is a major inconvenience - unless you already know the credentials and can easily re-login
• docker login response seems quite unreliable and not so easy to parse by the program

My solution that worked for me builds on @noobuntu's comment: I figured that if I already known the image that I want to pull, but I'm not sure if the user is already logged in, I can do this:

try pulling target image
-> on failure:
   try logging in
   -> on failure: throw CannotLogInException
   -> on success:
      try pulling target image
      -> on failure: throw CannotPullImageException
      -> on success: (continue)
-> on success: (continue)

The docker cli credential scheme is unsurprisingly uncomplicated, just take a look:

cat ~/.docker/config.json

{
  "auths": {
    "dockerregistry.myregistry.com": {},
    "https://index.docker.io/v1/": {}

This exists on Windows (use Get-Content ~\.docker\config.json) and you can also poke around the credential tool which also lists the username ... and I think you can even retrieve the password

. "C:\Program Files\Docker\Docker\resources\bin\docker-credential-wincred.exe" list

{"https://index.docker.io/v1/":"kcd"}

Just checked, today it looks like this:

$ docker login
Authenticating with existing credentials...
Login Succeeded

NOTE: this is on a macOS with the latest version of Docker CE, docker-credential-helper - both installed with homebrew.

If you want a simple true/false value, you can pipe your docker.json to jq.

is_logged_in() {
  cat ~/.docker/config.json | jq -r --arg url "${REPOSITORY_URL}" '.auths | has($url)'
}

if [[ "$(is_logged_in)" == "false" ]]; then
  # do stuff, log in
fi

Use command like below:

docker info | grep 'name'

WARNING: No swap limit support
Username: <strong>jonasm2009</strong>

My AWS ECR build-script has:

ECR_HOSTNAME="${ACCOUNT_ID}.dkr.ecr.${REGION}.amazonaws.com"
TOKEN=$(jq -r '.auths["'$ECR_HOSTNAME'"]["auth"]' ~/.docker/config.json)
curl --fail --header "Authorization: Basic $TOKEN" https://$ECR_HOSTNAME/v2/

If accessing ECR fails, a login is done:

aws ecr get-login-password --region ${REGION} | docker login --username AWS --password-stdin https://$ECR_HOSTNAME

For this to work, a proper Docker credential store cannot be used. Default credentials store of ~/.docker/config.json is assumed.

On windows you can inspect the login "authorizations" (auths) by looking at this file: [USER_HOME_DIR].docker\config.json

Example: c:\USERS\YOUR_USERANME.docker\config.json

It will look something like this for windows credentials

{
"auths": {
    "HOST_NAME_HERE": {},
    "https://index.docker.io/v1/": {}
},
"HttpHeaders": {
    "User-Agent": "Docker-Client/18.09.0 (windows)"
},
"credsStore": "wincred",
"stackOrchestrator": "swarm"
}

In Azure Container Registry (ACR) following works as a login-check:

registry="contosoregistry.azurecr.io"
curl -v --header "Authorization: Bearer $access_token" https://$registry/v2/_catalog

If access token has expired, a HTTP/401 will be returned.

Options for getting an access token are from ~/.docker/config.json or requesting one from https://$registry/oauth2/token using a refresh token stored into Docker credStore: echo $registry | docker-credential-desktop get.

More information about refresh tokens and access tokens are at ACR integration docs.

As pointed out by @Christian, best to try operation first then login only if necessary. Problem is that "if necessary" is not that obvious to do robustly. One approach is to compare the stderr of the docker operation with some strings that are known (by trial and error). For example,

try "docker OPERATION"
if it failed: 
    capture the stderr of "docker OPERATION"
    if it ends with "no basic auth credentials": 
        try docker login
    else if it ends with "not found":
        fatal error: image name/tag probably incorrect
    else if it ends with <other stuff you care to trap>:
        ...
    else:
        fatal error: unknown cause

try docker OPERATION again
if this fails: you're SOL!

On Linux if you have the secretservice enabled via the credsStore option in your ~/.docker/config.json like below:

"credsStore": "secretservice",

then you will not see the credentials in the config.json. Instead you need to query the credentials using the docker-credential-desktop, see the below answer for more details:

How to know if docker is already logged in to a docker registry server

Here's a powershell powershell command to check if you have previously logged into the registry, making use of the file $HOME/.docker/config.json that others have mentioned:

(Get-Content $HOME/.docker/config.json | ConvertFrom-Json).auths.PSobject.Properties.name -Contains "<registry_url>"

This returns a True / False boolean, so can use as follows:

if ((Get-Content $HOME/.docker/config.json | ConvertFrom-Json).auths.PSobject.Properties.name -Contains "<registry_url>" ) {
    Write-Host Already logged into docker registry
} else {
    Write-Host Logging into docker registry
    docker login
}

If you want it to not fail if the file doesn't exist you need an extra check:

if ( (-Not (Test-Path $HOME/.docker/config.json)) -Or (-Not (Get-Content $HOME/.docker/config.json | ConvertFrom-Json).auths.PSobject.Properties.name -Contains "<registry_url>") )
{
    Write-Host Already logged into docker registry
} else {
    Write-Host Logging into docker registry
    docker login
}

I chose to use the -Not Statements because for some reason when you chain a command after a failed condition with -And instead of -Or the command errors out.

To many answers above is just about how to check login status manually. To do it from command line you can use the command below.

cat ~/.docker/config.json | jq '.auths["<MY_REGISTRY_HOSTNAME>"]' -e > /dev/null &&  echo "OK" ||  echo "ERR"

1. Ensure you have jq command in your local. To test that run jq --version command. If you can't get an version output follow the directions from here to install it https://stedolan.github.io/jq/download/

2. Replace <MY_REGISTRY_HOSTNAME> with your registry address.

3. When you run it returns OK if you successfully login already otherwise ERR

NOTE: if you used a credential helper to login (e.g. google cloud auth tool for container registry) replace .auths keyword with .credHelpers

docker info | grep Username

This should print the login user.