Can't run flow.run_local_server from a Docker container

I am making a Flask API that I try to containerize.

I am using the google_auth_oauthlib module to get the authorization from the user of my application to use his YouTube account.

This is performed in the _get_authenticated_first_time function of this python file.
It works fine on my local server.

However, when I am tying to containerize my application with Docker, the function flow.run_local_server runs forever without redirecting me anywhere.

I tried to pass as port argument of the flow.run_local_server() the value 8080 and map my local port 8080 to the port 8080 of the container in my docker-compose.yaml file but it doesn't work either.

So my question is simple:
Do you know how to make a set up that allows to run the authentication flow inside a Docker container?

[kurtisvg]

Hi @lohiermichael,

What's happening is that flow.run_local_server() is bound to localhost inside the container, which isn't accessible from outside the container (even if you publish the port). So what happens is traffic to your hosts 127.0.0.1 is forward to the container on 172.17.x.x, but the server is listening on the guest 127.0.0.1. Unfortunately I'm not aware of a great workaround for this - (@busunkim96 it might be nice to add an optional redirect_url arg to run_local_server() to allow for some more flexibility here)

Two alternatives:

1. Host's network interface directly (so that the host and guest have the same 127.0.0.1) by passing --net=host from docker (looks like for docker-compose it might be network_mode: "host")
2. You can try run_console() instead, which asks the user to copy past the token into the console

[tswast]

You can try run_console() instead, which asks the user to copy past the token into the console

This flow has been deprecated. https://developers.googleblog.com/2022/02/making-oauth-flows-safer.html?m=1#disallowed-oob

[grbtm]

Another option is to change the localhost assignment in /etc/hosts in the container to the container's IP (hostname -i). That will make the local server in the container listen to the container's 172.17.x.x instead of 127.0.0.1.

[gilesknap]

I've made a PR to fix this #202

Feature request is #201

[NickGreen99]

@grbtm so could i just type docker run --hostname 172.17.x.x ?

[Cliffstone]

@gilesknap I would be interested in how to actually resolve this, did you make any changes to the oauth credentials(add/change the redirect_uris). What does the flow look like for you, are you able to complete without curling the localhost url from the container(like in #61)?

[gilesknap]

@Cliffstone Yes this works with the standard secret JSON with redirect URI as "http://localhost".

If you call run_local_server() with bind_host=="0.0.0.0" then the server will listen on all the container's network adapters and will therefore see the redirect.

[Cliffstone]

First, thank you for the contribution @gilesknap, I owe you a beer/equivalent 🍺

I can confirm that this works, the mistake was on me. I needed to make sure the container was not using the "old" pip google-oauthlib package. To anyone persisting with this problem, running python3 -m pip install git+https://github.com/googleapis/google-auth-library-python-oauthlib.git from inside your container will fix it.

I don't like the idea but until the changes reach downstream (pip) a temp fix could be to change the dockerfile so that it fetches the package from main rather than pip. To anyone having similar problems feel free to reach out to me...

[SShady97]

First, thank you for the contribution @gilesknap, I owe you a beer/equivalent 🍺

I can confirm that this works, the mistake was on me. I needed to make sure the container was not using the "old" pip google-oauthlib package. To anyone persisting with this problem, running python3 -m pip install git+https://github.com/googleapis/google-auth-library-python-oauthlib.git from inside your container will fix it.

I don't like the idea but until the changes reach downstream (pip) a temp fix could be to change the dockerfile so that it fetches the package from main rather than pip. To anyone having similar problems feel free to reach out to me...

You can help me? I can't get it to work

[gilesknap]

@SShady97 please describe the problem are you seeing?