Docker "login: error storing credentials" (Credential Helper) in CI

docker login authenticated but could not save the credentials. error storing credentials / credentials store ... not found means the configured credential helper (docker-credential-<x>) is missing or its secret backend (a keychain/secret-service) is unavailable on the runner.

What this error means

A docker login succeeds at the API level but fails with Error saving credentials: error storing credentials - err: exit status 1, out: <helper> or docker-credential-<x>: executable file not found. Subsequent pulls/pushes then act unauthenticated.

docker

Error saving credentials: error storing credentials - err: exit status 1,
out: 'error storing credentials - err: exit status 1, out: `The name org.freedesktop.secrets was not provided`'
# the secret-service / keychain backend is not available on a headless runner

Common causes

A credential helper backend not available on the runner

A credsStore like secretservice/osxkeychain needs a desktop secret backend. On a headless CI runner that backend is absent, so storing fails.

The credential helper binary is missing

A config.json referencing docker-credential-<x> that is not installed fails because the helper executable is not found.

Inherited config.json from another environment

A config.json carried over from a desktop (with a desktop credsStore) breaks on a server runner that has no such helper.

How to fix it

Use plaintext/file store in CI

Drop the desktop credsStore so credentials write to config.json (acceptable for ephemeral CI runners), or use the password-stdin flow.

Terminal

# remove the desktop credsStore for headless CI:
mkdir -p ~/.docker
echo '{}' > ~/.docker/config.json
echo "$TOKEN" | docker login ghcr.io -u "$USER" --password-stdin

Install the matching credential helper

If you must use a helper, install the docker-credential-<x> binary the config references.

How to prevent it

Avoid desktop credsStore values in CI config.json.
Use --password-stdin login on headless runners.
Do not carry a desktop ~/.docker/config.json onto server runners.