Install ATCR Credential Helper

The ATCR credential helper enables Docker to authenticate with ATCR registries using your ATProto identity.

Quick Install

Using install script

curl -fsSL atcr.io/static/install.sh | bash

Manual download

curl -fsSLO atcr.io/static/install.sh chmod +x install.sh ./install.sh

Using PowerShell (Run as Administrator)

iwr -useb atcr.io/static/install.ps1 | iex

Manual download

Invoke-WebRequest -Uri atcr.io/static/install.ps1 -OutFile install.ps1 .\install.ps1

Configure Docker

After installation, configure Docker to use the credential helper:

Create or edit ~/.docker/config.json

{ "credHelpers": { "atcr.io": "atcr" } }
Note: If you have an existing config.json, add the credHelpers entry to your existing configuration.

Authentication

The credential helper will automatically prompt for authentication when you push or pull:

docker push atcr.io/yourhandle/myapp:latest

This will:

  1. Open your browser for device authorization
  2. Display a code to confirm
  3. Store credentials securely
  4. Proceed with your push/pull operation
Success! Once authenticated, Docker commands work normally without any additional steps.

Alternative: Use docker login

You can also use docker login with your ATProto app password:

  1. Generate an app password at bsky.app/settings/app-passwords
  2. Run: docker login atcr.io
  3. Enter your handle as username
  4. Enter your app password
Note: Create an app password at bsky.app/settings/app-passwords.

Troubleshooting

Command not found

Ensure the credential helper is in your PATH:

# Check if installed which docker-credential-atcr # Add to PATH if needed export PATH="/usr/local/bin:$PATH"

Still having issues?

Check the full documentation or open an issue.

Security

  • Credentials are stored in ~/.atcr/device.json with secure permissions (0600)
  • Device secrets are issued per-device and can be revoked anytime
  • No passwords are stored locally
  • Uses ATProto OAuth with device authorization flow