World map

 

BM

World D5: Ship & Shield

Log in with a token

You will learn: to log in to a registry with a token you can cancel, never your password.

Checked with Docker Engine 29 on 31 Oct 2026

The problem

Your laptop~/kedai-api

  • No open hatches

Lunchboxes (containers)

  • No containers yet

Frozen packs (images)

  • kedai-api:1.06 layers · 244MB
  • node:24-alpine4 layers · 244MB

It worked, but Docker warns you. Plain words: your password now sits in your shell history. And that password opens your whole account.

Watch

An access token: A spare key for one job. Use it instead of your password, and cancel it if it leaks. is a spare key for one job. Lose it? Cancel that key. Your password stays the same. Sort these.

Drag a card into a box. Or tap the card, then tap the box.

      Watch

      The token waits in $DOCKER_TOKEN. --password-stdin reads it from a pipe, so it never shows on screen. Build the safe login.

      Tap the pieces in the right order.

      …

      Try it

      Now log in for real, with the token.

      Your laptop~/kedai-api

      • No open hatches

      Lunchboxes (containers)

      • No containers yet

      Frozen packs (images)

      • kedai-api:1.06 layers · 244MB
      • node:24-alpine4 layers · 244MB

      Predict

      Oops! Your token was in a file you pushed to a public repo. What do you do first?

      Check

      Safe habit, or risky? Swipe right for safe.

      Swipe right for good, left for needs work. Or use the buttons.

      1 / 4

      A read-only token for a robot that only pulls

      You did it!

      You can now log in with a token you can cancel.

      Go deeper (optional)

      Docker saves your login in ~/.docker/config.json. Without a credential helper, it is not encrypted, and Docker warns you. Docker Desktop uses your system’s keychain. docker logout removes the login. To push to GHCR, use a GitHub personal access token (classic) with write:packages.

      Real rep (optional), on your own machine:

      Real mission

      2. read -s DOCKER_TOKEN && export DOCKER_TOKEN
      3. echo $DOCKER_TOKEN | docker login -u YOUR-NAME --password-stdin
      4. docker logout

      0 of 4 steps done · Your ticks are saved.