loft-sh/docker-credential-acr-env

docker-credential-acr-env solves a specific headache: securely authenticating to Azure Container Registry in CI/CD pipelines without relying on the Azure CLI. When tools like kaniko build and push container images in automated environments, they need credentials to access the registry, but traditional methods often depend on interactive CLI logins or file-based credential stores that aren't well-suited for ephemeral CI runners. The credential helper works by reading authentication details from environment variables rather than files or CLI commands. It tries three authentication methods in order: first, it checks for client credentials (a client ID, secret, and tenant ID) set as environment variables. If those aren't present, it looks for a federated OIDC token, a modern approach that's increasingly used in CI platforms like GitHub Actions for keyless authentication. Finally, it falls back to Azure's managed identity endpoint, which works automatically when running inside Azure services like App Service or AKS. The primary users are teams running container builds in CI environments, particularly those using kaniko or similar tools that need to push images to Azure Container Registry. For example, if your GitHub Actions workflow builds a Docker image and pushes it to ACR, this helper lets you authenticate via OIDC federation without managing long-lived service principal secrets. Teams using Azure Kubernetes Service can also benefit, as the managed identity fallback handles authentication transparently. What's notable is the design choice to source everything from environment variables. This makes the helper stateless and ideal for ephemeral CI runners where you can't rely on persistent credential files. The README doesn't go into detail on installation or configuration beyond the environment variables, so users should be comfortable setting those up in their CI platform of choice.