WebStorm 2023.3 Docker integration: handling expired registry credentials without storing passwords

Answer

When a registry token expires mid-session, WebStorm 2023.3 does not re-trigger a login flow. The IDE delegates authentication to Docker Desktop's credential helper; when the daemon returns HTTP 401, WebStorm surfaces a generic "unauthorized: authentication required" error in the run configuration console. You must re-authenticate outside the IDE (docker login or the Docker Desktop UI) and then re-run the configuration.

Confirmed facts

• WebStorm does not store registry passwords; it relies on Docker Desktop's credential helper, so token expiry appears as an authentication failure from the daemon.
• You can scope least-privilege tokens by creating a separate Docker connection pointing to a distinct Docker context or a custom DOCKER_CONFIG directory with its own config.json containing a read-only token.
• With TLS client certificates, the Docker daemon owns certificate validation; WebStorm shows a connection error on expiry and does not prompt for renewal—certs must be renewed externally.

Likely explanation

WebStorm calls the Docker API for every pull/push. If the credential helper returns an expired token, the daemon answers 401 and WebStorm propagates that error unchanged. The IDE assumes the helper handles refresh, so no re-login dialog appears. This is the likely behavior, not fully confirmed for all setups—custom credential helpers or SSH-based auth may alter the flow.

Scoping a least-privilege token

1. Create a dedicated Docker context: docker context create ws-least --docker "host=unix:///var/run/docker.sock".
2. Configure the context's config.json with a short-lived, read-only token under auths for your registry.
3. In WebStorm, open Settings → Build, Execution, Deployment → Docker, add a new connection bound to that context, and name it (e.g., "WS-Least").
4. Assign only the run configurations that need it to this connection; others keep the default connection and their own credentials.

TLS client certificates

1. Renew the cert and key files outside WebStorm before expiry, then restart the daemon or reload the context.
2. If the cert lapses, WebStorm reports a connection failure (e.g., certificate errors) and will not prompt—renewal is the daemon's/administrator's job, not the IDE's.

Verification

To confirm: create a short-lived token, run a pull from WebStorm, wait for expiry, and attempt another pull—you should see an unauthorized error with no re-login prompt. For least-privilege scoping, assign a run configuration to the separate connection and verify other configurations still work. For TLS, use a short-validity client cert and check that expiry produces a connection failure without a renewal prompt.

Missing diagnostic detail

Whether you use Docker Desktop's credential helper or a custom helper determines where re-login must happen (Docker CLI vs. helper-specific tooling). Confirm your helper type, as it changes the recovery step but not the IDE behavior.