Support OIDC identities for docker login

[mlbiam]

Tell us about your request
Currently dockerhub requires a static token or password. These tokens are easily lost and hard to track and replace. It would be much better for dockerhub to support an oidc identity that can be created by a pipeline as opposed to a static token. These tokens can be validated by either a public well-known oidc discovery document or via a pinned certificate for private pipelines.

Which service(s) is this request for?
dockerhub

Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?
I want to be able to securely publish containers from my GitHub actions pipeline with the pipeline's identity, rather then a static account stored as a secret.

Are you currently working around the issue?
Not yet, though planning to

Additional context
Add any other context or screenshots about the feature request here.

[martin-traverse]

Hi, any update on this? We're using OIDC for integrations with the cloud platforms, would be great to have that for pushing to Docker Hub as well.

Apologies if there is another way of doing this that I have missed!

[dotjoshrc]

Hey friends, I realize this is a very old ticket and we have been wanting to do this for quite a while now. Happy to say that we are starting planning and scoping out what an OIDC type of provider would look like for registry and hub. Nothing solid yet, but just an update 😄

[dotjoshrc]

Hello all! Just an update here. We have our first system design and are underway on this!

We hear ya on the "Bring my own auth for OIDC" and we'll get there, but the first implementation of this will be GitHub Actions OIDC to start. A lot of what we are designing is a more broad implementation so this can branch into whatever customers want to use.

Thanks for the patience and expect more updates in Q1 of this year. 🎉