docker-stack 2.2.1__tar.gz → 2.2.3__tar.gz

{docker_stack-2.2.1 → docker_stack-2.2.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: docker-stack
-Version: 2.2.1
+Version: 2.2.3
 Summary: CLI for deploying and managing Docker stacks.
 Home-page: https://github.com/mesudip/docker-stack
 Author: Sudip Bhattarai

{docker_stack-2.2.1 → docker_stack-2.2.3}/docker_stack/cli.py

@@ -266,15 +266,35 @@ def _format_names(names: object, *, no_trunc: bool) -> str:
     return ",".join(values)
 
 
+DOCKER_HUB_NAME_PREFIXES = (
+    "docker.io/library/",
+    "index.docker.io/library/",
+    "docker.io/",
+    "index.docker.io/",
+)
+
+
+def _familiar_image_name(value: str) -> str:
+    for prefix in DOCKER_HUB_NAME_PREFIXES:
+        if value.startswith(prefix):
+            return value[len(prefix) :]
+    return value
+
+
 def _format_image(image: object, image_id: object, *, no_trunc: bool) -> str:
     value = str(image or "")
     if not value:
         return "<no image>"
     if no_trunc:
         return value
+    if value.startswith("sha256:"):
+        return _short_id(value)
     identifier = str(image_id or "")
     if identifier and _short_id(identifier) == _short_id(value):
         return _short_id(value)
+    if "@" in value:
+        # docker ps keeps `name[:tag]` and drops the pinned digest unless --no-trunc.
+        return _familiar_image_name(value.split("@", 1)[0])
     return value
 
 
@@ -1752,6 +1772,7 @@ def open_context_shell(config_dir: Path, context_name: str) -> int:
         env.pop(key, None)
     env["DOCKER_CONFIG"] = str(config_dir)
     env["DOCKER_CONTEXT"] = context_name
+    env["DOCKER_MANAGER_CONTEXT_NAME"] = context_name
     shell = env.get("SHELL", "").strip() or "/bin/bash"
     return subprocess.run([shell, "-i"], check=False, env=env).returncode
 

{docker_stack-2.2.1 → docker_stack-2.2.3}/docker_stack/login.py

@@ -14,7 +14,7 @@ import webbrowser
 from dataclasses import dataclass
 from http.server import BaseHTTPRequestHandler, HTTPServer
 from pathlib import Path
-from typing import Callable, Dict, Optional
+from typing import Callable, Dict, Optional, Tuple
 
 from docker_stack.command_runner import run_command
 
@@ -111,8 +111,132 @@ def _candidate_urls(target: str, *, verify_ssl: bool) -> list[str]:
     return [https_candidate, f"http://{normalized_target}:2375"]
 
 
-def probe_manager_url(url: str, *, timeout: int = 3, verify_tls: bool = True) -> tuple[bool, bool]:
-    request = urllib.request.Request(f"{url.rstrip('/')}/_ping", method="GET")
+DOCKER_MANAGER_SKIP_TLS_VERIFY_ENV = "DOCKER_MANAGER_SKIP_TLS_VERIFY"
+LOOPBACK_HOSTS = {"localhost", "127.0.0.1", "::1"}
+_TRUTHY_VALUES = {"1", "true", "yes", "on"}
+_FALSY_VALUES = {"0", "false", "no", "off"}
+_CONTEXT_INSPECT_CACHE: Dict[Tuple[str, str], Optional[Dict[str, object]]] = {}
+
+
+def _parse_bool(value: Optional[str]) -> Optional[bool]:
+    if value is None:
+        return None
+    normalized = value.strip().lower()
+    if normalized in _TRUTHY_VALUES:
+        return True
+    if normalized in _FALSY_VALUES:
+        return False
+    return None
+
+
+def _host_and_port(value: str) -> Optional[Tuple[str, Optional[int]]]:
+    target = normalize_manager_target(value)
+    parsed = urllib.parse.urlparse(target if "://" in target else f"//{target}")
+    if not parsed.hostname:
+        return None
+    try:
+        port = parsed.port
+    except ValueError:
+        return None
+    return parsed.hostname.lower(), port
+
+
+def docker_config_path(docker_config_dir: Optional[Path] = None) -> Path:
+    if docker_config_dir is None:
+        configured = os.getenv("DOCKER_CONFIG", "").strip()
+        docker_config_dir = Path(configured) if configured else Path.home() / ".docker"
+    return Path(docker_config_dir) / "config.json"
+
+
+def docker_config_http_headers(docker_config_dir: Optional[Path] = None) -> Dict[str, str]:
+    """Headers the Docker CLI sends to the manager, including the access token."""
+    try:
+        payload = read_docker_config(docker_config_path(docker_config_dir))
+    except RuntimeError:
+        return {}
+    headers = payload.get("HttpHeaders")
+    if not isinstance(headers, dict):
+        return {}
+    return {
+        str(key): str(value)
+        for key, value in headers.items()
+        if isinstance(key, str) and isinstance(value, str) and key.strip() and value.strip()
+    }
+
+
+def _probe_headers(url: str, headers: Optional[Dict[str, str]]) -> Dict[str, str]:
+    if not headers:
+        return {}
+    if url.startswith("https://"):
+        return dict(headers)
+    host = (_host_and_port(url) or ("", None))[0]
+    if host in LOOPBACK_HOSTS:
+        return dict(headers)
+    # Never put the access token on the wire in cleartext towards a remote host.
+    return {key: value for key, value in headers.items() if key.lower() != "authorization"}
+
+
+def _docker_context_skip_tls_verify(context_payload: Optional[Dict[str, object]]) -> Optional[bool]:
+    if not isinstance(context_payload, dict):
+        return None
+    endpoints = context_payload.get("Endpoints") or context_payload.get("endpoints") or {}
+    docker_endpoint = {}
+    if isinstance(endpoints, dict):
+        docker_endpoint = endpoints.get("docker") or endpoints.get("Docker") or {}
+    if not isinstance(docker_endpoint, dict):
+        return None
+    value = docker_endpoint.get("SkipTLSVerify")
+    if value is None:
+        value = docker_endpoint.get("skipTLSVerify")
+    return bool(value) if isinstance(value, bool) else None
+
+
+def _skip_tls_verify_hint(
+    target: str,
+    *,
+    context_name: Optional[str] = None,
+    docker_config_dir: Optional[Path] = None,
+) -> Optional[bool]:
+    """The TLS mode of an endpoint we already configured, so probing it again is unnecessary."""
+    env_hint = _parse_bool(os.getenv(DOCKER_MANAGER_SKIP_TLS_VERIFY_ENV))
+    if env_hint is not None:
+        return env_hint
+    target_origin = _host_and_port(target)
+    if target_origin is None or target_origin[1] is None:
+        return None
+    candidate_names = [
+        context_name,
+        os.getenv("DOCKER_MANAGER_CONTEXT_NAME"),
+        os.getenv("DOCKER_CONTEXT"),
+    ]
+    seen = set()
+    for name in candidate_names:
+        name = (name or "").strip()
+        if not name or name in seen:
+            continue
+        seen.add(name)
+        payload = _inspect_docker_context(name, docker_config_dir)
+        host = _docker_context_host(payload)
+        if not host or _host_and_port(host) != target_origin:
+            continue
+        hint = _docker_context_skip_tls_verify(payload)
+        if hint is not None:
+            return hint
+    return None
+
+
+def probe_manager_url(
+    url: str,
+    *,
+    timeout: int = 3,
+    verify_tls: bool = True,
+    headers: Optional[Dict[str, str]] = None,
+) -> tuple[bool, bool]:
+    request = urllib.request.Request(
+        f"{url.rstrip('/')}/_ping",
+        method="GET",
+        headers=_probe_headers(url, headers),
+    )
     context = None
     if url.startswith("https://") and not verify_tls:
         context = ssl._create_unverified_context()
@@ -132,20 +256,34 @@ def probe_manager_url(url: str, *, timeout: int = 3, verify_tls: bool = True) ->
         return False, True
 
 
-def detect_manager_url(target: str, *, verify_ssl: bool = False) -> tuple[str, bool]:
+def detect_manager_url(
+    target: str,
+    *,
+    verify_ssl: bool = False,
+    skip_tls_verify: Optional[bool] = None,
+    headers: Optional[Dict[str, str]] = None,
+) -> tuple[str, bool]:
     normalized_target = normalize_manager_target(target)
     parsed = urllib.parse.urlparse(normalized_target)
     explicit_scheme = parsed.scheme in {"http", "https"}
 
     candidates = _candidate_urls(normalized_target, verify_ssl=verify_ssl)
     tls_verification_failed = False
+    known_skip_tls_verify = None if verify_ssl else skip_tls_verify
 
     for candidate in candidates:
-        success, cert_failed = probe_manager_url(candidate, verify_tls=True)
+        if known_skip_tls_verify and candidate.startswith("https://"):
+            # The endpoint is known to serve a certificate this trust store cannot
+            # verify. A verified handshake would only abort with an UnknownCA alert.
+            insecure_success, _ = probe_manager_url(candidate, verify_tls=False, headers=headers)
+            if insecure_success:
+                return candidate, True
+            continue
+        success, cert_failed = probe_manager_url(candidate, verify_tls=True, headers=headers)
         if success:
             return candidate, False
         if candidate.startswith("https://") and cert_failed and not verify_ssl:
-            insecure_success, _ = probe_manager_url(candidate, verify_tls=False)
+            insecure_success, _ = probe_manager_url(candidate, verify_tls=False, headers=headers)
             if insecure_success:
                 return candidate, True
             tls_verification_failed = True
@@ -203,6 +341,13 @@ def _docker_env(docker_config_dir: Optional[Path] = None) -> Dict[str, str]:
 
 
 def _inspect_docker_context(context_name: str, docker_config_dir: Optional[Path] = None) -> Optional[Dict[str, object]]:
+    cache_key = (context_name, str(docker_config_dir or os.getenv("DOCKER_CONFIG", "")))
+    if cache_key not in _CONTEXT_INSPECT_CACHE:
+        _CONTEXT_INSPECT_CACHE[cache_key] = _read_docker_context(context_name, docker_config_dir)
+    return _CONTEXT_INSPECT_CACHE[cache_key]
+
+
+def _read_docker_context(context_name: str, docker_config_dir: Optional[Path] = None) -> Optional[Dict[str, object]]:
     inspect = subprocess.run(
         ["docker", "context", "inspect", context_name],
         text=True,
@@ -256,6 +401,42 @@ def docker_context_target(context_name: str, docker_config_dir: Optional[Path] =
     return _docker_context_host(_inspect_docker_context(context_name, docker_config_dir))
 
 
+def _resolve_manager_endpoint(
+    target: str,
+    *,
+    verify_ssl: bool = False,
+    context_name: Optional[str] = None,
+    docker_config_dir: Optional[Path] = None,
+) -> tuple[str, bool]:
+    """Resolve the manager URL, avoiding probes when the endpoint is already configured."""
+    normalized_target = normalize_manager_target(target)
+    headers = docker_config_http_headers(docker_config_dir)
+    hint = None
+    if not verify_ssl:
+        hint = _skip_tls_verify_hint(
+            normalized_target,
+            context_name=context_name,
+            docker_config_dir=docker_config_dir,
+        )
+        if hint is not None:
+            candidates = _candidate_urls(normalized_target, verify_ssl=False)
+            if len(candidates) == 1:
+                candidate = candidates[0]
+                return candidate, hint if candidate.startswith("https://") else False
+            if hint:
+                # Skipping verification only applies to a TLS endpoint, so the
+                # scheme is settled too and no candidate probing is needed.
+                for candidate in candidates:
+                    if candidate.startswith("https://"):
+                        return candidate, True
+    return detect_manager_url(
+        normalized_target,
+        verify_ssl=verify_ssl,
+        skip_tls_verify=hint,
+        headers=headers,
+    )
+
+
 def resolve_login_config(
     *,
     manager_url: Optional[str] = None,
@@ -285,19 +466,45 @@ def resolve_login_config(
             inferred_context_name = manager_target
             if isolated_context_target:
                 resolved_docker_config_dir = isolated_config_dir
+    endpoint_context_name = (
+        context_name
+        or os.getenv("DOCKER_MANAGER_CONTEXT_NAME")
+        or inferred_context_name
+        or current_context_name
+    )
     if manager_target:
-        resolved_manager_url, skip_tls_verify = detect_manager_url(raw_manager_value, verify_ssl=verify_ssl)
+        resolved_manager_url, skip_tls_verify = _resolve_manager_endpoint(
+            raw_manager_value,
+            verify_ssl=verify_ssl,
+            context_name=endpoint_context_name,
+            docker_config_dir=resolved_docker_config_dir,
+        )
     elif manager_url:
         resolved_manager_url = normalize_loopback_host(raw_manager_value)
         skip_tls_verify = False
         if resolved_manager_url.startswith("https://"):
-            _, skip_tls_verify = detect_manager_url(resolved_manager_url, verify_ssl=verify_ssl)
+            _, skip_tls_verify = _resolve_manager_endpoint(
+                resolved_manager_url,
+                verify_ssl=verify_ssl,
+                context_name=endpoint_context_name,
+                docker_config_dir=resolved_docker_config_dir,
+            )
         elif verify_ssl:
             raise RuntimeError("verify_ssl=true requires an HTTPS manager URL")
     elif env_manager_value and "://" not in env_manager_value:
-        resolved_manager_url, skip_tls_verify = detect_manager_url(raw_manager_value, verify_ssl=verify_ssl)
+        resolved_manager_url, skip_tls_verify = _resolve_manager_endpoint(
+            raw_manager_value,
+            verify_ssl=verify_ssl,
+            context_name=endpoint_context_name,
+            docker_config_dir=resolved_docker_config_dir,
+        )
     elif current_context_target:
-        resolved_manager_url, skip_tls_verify = detect_manager_url(raw_manager_value, verify_ssl=verify_ssl)
+        resolved_manager_url, skip_tls_verify = _resolve_manager_endpoint(
+            raw_manager_value,
+            verify_ssl=verify_ssl,
+            context_name=endpoint_context_name,
+            docker_config_dir=resolved_docker_config_dir,
+        )
     else:
         resolved_manager_url = normalize_loopback_host(raw_manager_value)
         skip_tls_verify = False
@@ -323,7 +530,7 @@ def resolve_context_login_config(
     target = docker_context_target(context_name)
     if not target:
         raise RuntimeError(f"Docker context '{context_name}' does not have a TCP/HTTP(S) Docker endpoint")
-    resolved_manager_url, skip_tls_verify = detect_manager_url(target)
+    resolved_manager_url, skip_tls_verify = _resolve_manager_endpoint(target, context_name=context_name)
     return DockerManagerLoginConfig(
         manager_url=resolved_manager_url,
         context_name=context_name,
@@ -343,7 +550,10 @@ def resolve_shell_login_config(
         resolved_context_name = context_name or shell_name
         if not resolved_context_name:
             raise RuntimeError("Pass --context <name> when providing a manager target")
-        resolved_manager_url, skip_tls_verify = detect_manager_url(manager_target)
+        resolved_manager_url, skip_tls_verify = _resolve_manager_endpoint(
+            manager_target,
+            context_name=resolved_context_name,
+        )
         return DockerManagerLoginConfig(
             manager_url=resolved_manager_url,
             context_name=resolved_context_name,
@@ -360,7 +570,11 @@ def resolve_shell_login_config(
         target = persisted_target or docker_context_target(resolved_context_name)
         if not target:
             raise UnknownShellContextError(resolved_context_name)
-        resolved_manager_url, skip_tls_verify = detect_manager_url(target)
+        resolved_manager_url, skip_tls_verify = _resolve_manager_endpoint(
+            target,
+            context_name=resolved_context_name,
+            docker_config_dir=isolated_docker_config_dir(resolved_context_name) if persisted_target else None,
+        )
         return DockerManagerLoginConfig(
             manager_url=resolved_manager_url,
             context_name=resolved_context_name,
@@ -370,7 +584,10 @@ def resolve_shell_login_config(
 
     current_context_name, current_target = current_docker_context_target()
     if current_context_name and current_target:
-        resolved_manager_url, skip_tls_verify = detect_manager_url(current_target)
+        resolved_manager_url, skip_tls_verify = _resolve_manager_endpoint(
+            current_target,
+            context_name=current_context_name,
+        )
         return DockerManagerLoginConfig(
             manager_url=resolved_manager_url,
             context_name=current_context_name,

{docker_stack-2.2.1 → docker_stack-2.2.3}/docker_stack/shell_auth.py

@@ -16,6 +16,7 @@ from pathlib import Path
 from typing import Any, Dict, Optional
 
 from docker_stack.login import (
+    DOCKER_MANAGER_SKIP_TLS_VERIFY_ENV,
     DockerManagerLoginConfig,
     DockerManagerLoginResult,
     browser_login,
@@ -733,6 +734,10 @@ def run_managed_shell(config: DockerManagerLoginConfig, result: DockerManagerLog
         env["DOCKER_CONTEXT"] = config.context_name
         env["DOCKER_MANAGER_URL"] = config.manager_url
         env["DOCKER_MANAGER_CONTEXT_NAME"] = config.context_name
+        # The endpoint's TLS mode is already known, so in-shell commands never
+        # need to re-probe it (a verified probe against a private CA only
+        # produces aborted TLS connections on the manager).
+        env[DOCKER_MANAGER_SKIP_TLS_VERIFY_ENV] = "1" if config.skip_tls_verify else "0"
         env[SHELL_ORIGINAL_ZDOTDIR_ENV] = str(
             Path(os.getenv(SHELL_ORIGINAL_ZDOTDIR_ENV) or os.getenv("ZDOTDIR", str(Path.home())))
         )

{docker_stack-2.2.1 → docker_stack-2.2.3}/docker_stack.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: docker-stack
-Version: 2.2.1
+Version: 2.2.3
 Summary: CLI for deploying and managing Docker stacks.
 Home-page: https://github.com/mesudip/docker-stack
 Author: Sudip Bhattarai

{docker_stack-2.2.1 → docker_stack-2.2.3}/setup.py

@@ -2,7 +2,7 @@ from setuptools import setup, find_packages
 
 setup(
     name="docker-stack",
-    version="2.2.1",
+    version="2.2.3",
     description="CLI for deploying and managing Docker stacks.",
     long_description=open("README.md").read(),  # You can include a README file to describe your package
     long_description_content_type="text/markdown",

{docker_stack-2.2.1 → docker_stack-2.2.3}/tests/test_docker_stack.py

@@ -131,6 +131,57 @@ def test_managed_docker_ps_matches_docker_columns(monkeypatch, capsys):
     assert row == row.rstrip()
 
 
+@pytest.mark.parametrize(
+    "image,expected,expected_no_trunc",
+    [
+        (
+            "registry.example.com/app/design-system:af037b33@sha256:15d623cfa2f856c8101f9f3c47003d412f9b2bf72c69c95d5dff07a74e5f7b60",
+            "registry.example.com/app/design-system:af037b33",
+            "registry.example.com/app/design-system:af037b33@sha256:15d623cfa2f856c8101f9f3c47003d412f9b2bf72c69c95d5dff07a74e5f7b60",
+        ),
+        (
+            "docker.io/library/alpine@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b",
+            "alpine",
+            "docker.io/library/alpine@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b",
+        ),
+        ("nginx:1.27", "nginx:1.27", "nginx:1.27"),
+        (
+            "sha256:0e901e68141fd02f237cf63eb842529f8a9500636a9419e3cf4fb986b8fe3d5d",
+            "0e901e68141f",
+            "sha256:0e901e68141fd02f237cf63eb842529f8a9500636a9419e3cf4fb986b8fe3d5d",
+        ),
+    ],
+)
+def test_managed_docker_ps_drops_pinned_digest_like_docker(monkeypatch, capsys, image, expected, expected_no_trunc):
+    client = SimpleNamespace(
+        supports=lambda feature: feature == "cluster_container_cli_v1",
+        list_containers=lambda **_kwargs: {
+            "containers": [
+                {
+                    "node_name": "worker-02",
+                    "docker": {
+                        "Id": "abcdef1234567890",
+                        "Image": image,
+                        "Command": "sleep",
+                        "Created": int(time.time()) - 60,
+                        "Status": "Up 1 minute",
+                        "Ports": [],
+                        "Names": ["/svc.1.abc"],
+                    },
+                }
+            ],
+            "node_errors": [],
+        },
+    )
+    monkeypatch.setattr("docker_stack.cli.discover_manager_client", lambda: client)
+
+    assert _managed_docker(["ps"]) == 0
+    assert capsys.readouterr().out.splitlines()[1].split()[1] == expected
+
+    assert _managed_docker(["ps", "--no-trunc"]) == 0
+    assert capsys.readouterr().out.splitlines()[1].split()[1] == expected_no_trunc
+
+
 def test_managed_docker_ps_forwards_global_latest_and_limit(monkeypatch):
     calls = []
     client = SimpleNamespace(

{docker_stack-2.2.1 → docker_stack-2.2.3}/tests/test_login.py

@@ -9,12 +9,15 @@ import urllib.request
 import pytest
 
 from docker_stack.login import (
+    DOCKER_MANAGER_SKIP_TLS_VERIFY_ENV,
     clear_docker_config_authorization_header,
     DockerManagerLoginConfig,
     build_auth_url,
     browser_login,
     configure_docker_context,
     detect_manager_url,
+    docker_config_http_headers,
+    probe_manager_url,
     ensure_isolated_login,
     format_expiry,
     isolated_docker_config_dir,
@@ -254,7 +257,7 @@ def test_configure_docker_context_uses_skip_tls_verify_for_detected_tls(monkeypa
 
 
 def test_detect_manager_url_prefers_https_when_available(monkeypatch):
-    def fake_probe(url, *, timeout=3, verify_tls=True):
+    def fake_probe(url, *, timeout=3, verify_tls=True, headers=None):
         if url == "https://172.31.0.6:2376":
             return True, False
         return False, False
@@ -268,7 +271,7 @@ def test_detect_manager_url_prefers_https_when_available(monkeypatch):
 
 
 def test_detect_manager_url_marks_skip_verify_for_self_signed_tls(monkeypatch):
-    def fake_probe(url, *, timeout=3, verify_tls=True):
+    def fake_probe(url, *, timeout=3, verify_tls=True, headers=None):
         if url == "https://172.31.0.6:2376" and verify_tls:
             return False, True
         if url == "https://172.31.0.6:2376" and not verify_tls:
@@ -284,7 +287,7 @@ def test_detect_manager_url_marks_skip_verify_for_self_signed_tls(monkeypatch):
 
 
 def test_detect_manager_url_uses_http_default_port_when_https_unavailable(monkeypatch):
-    def fake_probe(url, *, timeout=3, verify_tls=True):
+    def fake_probe(url, *, timeout=3, verify_tls=True, headers=None):
         if url == "http://172.31.0.6:2375":
             return True, False
         return False, False
@@ -297,6 +300,144 @@ def test_detect_manager_url_uses_http_default_port_when_https_unavailable(monkey
     assert skip_tls_verify is False
 
 
+def test_detect_manager_url_skips_verified_probe_when_tls_mode_is_known(monkeypatch):
+    attempts = []
+
+    def fake_probe(url, *, timeout=3, verify_tls=True, headers=None):
+        attempts.append((url, verify_tls))
+        return (not verify_tls), False
+
+    monkeypatch.setattr("docker_stack.login.probe_manager_url", fake_probe)
+
+    url, skip_tls_verify = detect_manager_url("https://localhost:2376", skip_tls_verify=True)
+
+    assert url == "https://localhost:2376"
+    assert skip_tls_verify is True
+    # A verified handshake against a private CA is what produced UnknownCA alerts.
+    assert attempts == [("https://localhost:2376", False)]
+
+
+def test_detect_manager_url_ignores_skip_hint_when_verification_is_required(monkeypatch):
+    attempts = []
+
+    def fake_probe(url, *, timeout=3, verify_tls=True, headers=None):
+        attempts.append((url, verify_tls))
+        return verify_tls, False
+
+    monkeypatch.setattr("docker_stack.login.probe_manager_url", fake_probe)
+
+    url, skip_tls_verify = detect_manager_url(
+        "https://localhost:2376",
+        verify_ssl=True,
+        skip_tls_verify=True,
+    )
+
+    assert url == "https://localhost:2376"
+    assert skip_tls_verify is False
+    assert attempts == [("https://localhost:2376", True)]
+
+
+def test_probe_manager_url_sends_docker_config_headers(monkeypatch):
+    captured = {}
+
+    class FakeResponse:
+        def __enter__(self):
+            return self
+
+        def __exit__(self, *_args):
+            return False
+
+        def read(self, _size=None):
+            return b""
+
+    def fake_urlopen(request, timeout=None, context=None):
+        captured["url"] = request.full_url
+        captured["headers"] = dict(request.header_items())
+        return FakeResponse()
+
+    monkeypatch.setattr("docker_stack.login.urllib.request.urlopen", fake_urlopen)
+
+    assert probe_manager_url(
+        "https://localhost:2376",
+        headers={"Authorization": "Bearer token-value"},
+    ) == (True, False)
+    assert captured["url"] == "https://localhost:2376/_ping"
+    assert captured["headers"]["Authorization"] == "Bearer token-value"
+
+
+def test_probe_manager_url_withholds_token_over_remote_cleartext(monkeypatch):
+    captured = {}
+
+    class FakeResponse:
+        def __enter__(self):
+            return self
+
+        def __exit__(self, *_args):
+            return False
+
+        def read(self, _size=None):
+            return b""
+
+    def fake_urlopen(request, timeout=None, context=None):
+        captured["headers"] = dict(request.header_items())
+        return FakeResponse()
+
+    monkeypatch.setattr("docker_stack.login.urllib.request.urlopen", fake_urlopen)
+
+    probe_manager_url("http://manager.example.com:2375", headers={"Authorization": "Bearer token-value"})
+
+    assert "Authorization" not in captured["headers"]
+
+    probe_manager_url("http://localhost:2375", headers={"Authorization": "Bearer token-value"})
+
+    assert captured["headers"]["Authorization"] == "Bearer token-value"
+
+
+def test_docker_config_http_headers_reads_active_config(monkeypatch, tmp_path):
+    (tmp_path / "config.json").write_text(
+        json.dumps({"HttpHeaders": {"Authorization": "Bearer token-value", "X-Empty": " "}}),
+        encoding="utf-8",
+    )
+    monkeypatch.setenv("DOCKER_CONFIG", str(tmp_path))
+
+    assert docker_config_http_headers() == {"Authorization": "Bearer token-value"}
+
+
+def test_resolve_login_config_skips_probing_when_shell_exports_tls_mode(monkeypatch):
+    def fail_probe(*_args, **_kwargs):
+        raise AssertionError("the manager must not be probed when its TLS mode is known")
+
+    monkeypatch.setattr("docker_stack.login.probe_manager_url", fail_probe)
+    monkeypatch.setenv("DOCKER_MANAGER_URL", "https://localhost:2376")
+    monkeypatch.setenv(DOCKER_MANAGER_SKIP_TLS_VERIFY_ENV, "1")
+
+    config = resolve_login_config(manager_target="https://localhost:2376")
+
+    assert config.manager_url == "https://localhost:2376"
+    assert config.skip_tls_verify is True
+
+
+def test_resolve_login_config_reuses_context_tls_mode(monkeypatch):
+    def fail_probe(*_args, **_kwargs):
+        raise AssertionError("the manager must not be probed when its TLS mode is known")
+
+    monkeypatch.setattr("docker_stack.login.probe_manager_url", fail_probe)
+    monkeypatch.setattr(
+        "docker_stack.login._inspect_docker_context",
+        lambda name, docker_config_dir=None: {
+            "Name": name,
+            "Endpoints": {"docker": {"Host": "tcp://localhost:2376", "SkipTLSVerify": True}},
+        },
+    )
+    monkeypatch.delenv(DOCKER_MANAGER_SKIP_TLS_VERIFY_ENV, raising=False)
+    monkeypatch.setenv("DOCKER_CONTEXT", "local")
+
+    config = resolve_login_config(manager_target="tcp://localhost:2376")
+
+    assert config.manager_url == "https://localhost:2376"
+    assert config.skip_tls_verify is True
+
+
 def test_detect_manager_url_verify_ssl_requires_https(monkeypatch):
     with pytest.raises(RuntimeError, match="requires an HTTPS manager URL"):
         detect_manager_url("http://172.31.0.6", verify_ssl=True)
@@ -361,7 +502,7 @@ def test_resolve_login_config_ignores_malformed_context_host(monkeypatch):
 
 
 def test_resolve_login_config_detects_tls_for_positional_target(monkeypatch):
-    monkeypatch.setattr("docker_stack.login.detect_manager_url", lambda value, verify_ssl=False: ("https://172.31.0.6:2378", True))
+    monkeypatch.setattr("docker_stack.login.detect_manager_url", lambda value, verify_ssl=False, **_kwargs: ("https://172.31.0.6:2378", True))
 
     config = resolve_login_config(manager_target="172.31.0.6:2378", context_name="office")
 
@@ -375,7 +516,7 @@ def test_resolve_login_config_prefers_named_context_for_portless_target(monkeypa
         "docker_stack.login.docker_context_target",
         lambda context_name, docker_config_dir=None: "tcp://172.31.0.6:2378" if context_name == "office" else None,
     )
-    monkeypatch.setattr("docker_stack.login.detect_manager_url", lambda value, verify_ssl=False: ("https://172.31.0.6:2378", True))
+    monkeypatch.setattr("docker_stack.login.detect_manager_url", lambda value, verify_ssl=False, **_kwargs: ("https://172.31.0.6:2378", True))
 
     config = resolve_login_config(manager_target="office")
 
@@ -394,7 +535,7 @@ def test_resolve_login_config_prefers_isolated_named_context(monkeypatch, tmp_pa
     )
     monkeypatch.setattr(
         "docker_stack.login.detect_manager_url",
-        lambda value, verify_ssl=False: ("https://172.31.3.3:2376", False),
+        lambda value, verify_ssl=False, **_kwargs: ("https://172.31.3.3:2376", False),
     )
 
     config = resolve_login_config(manager_target="saas-a")
@@ -409,7 +550,7 @@ def test_resolve_login_config_uses_current_context_target(monkeypatch):
         "docker_stack.login.current_docker_context_target",
         lambda: ("office", "tcp://172.31.0.6:2378"),
     )
-    monkeypatch.setattr("docker_stack.login.detect_manager_url", lambda value, verify_ssl=False: ("https://172.31.0.6:2378", True))
+    monkeypatch.setattr("docker_stack.login.detect_manager_url", lambda value, verify_ssl=False, **_kwargs: ("https://172.31.0.6:2378", True))
 
     config = resolve_login_config()
 
@@ -434,7 +575,7 @@ def test_resolve_shell_login_config_uses_persisted_context(monkeypatch):
             "tcp://172.31.0.6:2378" if docker_config_dir == isolated_docker_config_dir("office") else None
         ),
     )
-    monkeypatch.setattr("docker_stack.login.detect_manager_url", lambda value: ("https://172.31.0.6:2378", True))
+    monkeypatch.setattr("docker_stack.login.detect_manager_url", lambda value, **_kwargs: ("https://172.31.0.6:2378", True))
 
     config = resolve_shell_login_config(shell_name="office", manager_target=None, context_name=None)