From f8e1a8601915771584a3fb7e180e39f8b6927a9f Mon Sep 17 00:00:00 2001
From: Peter Du <peterd@nvidia.com>
Date: Tue, 18 Aug 2026 14:28:47 -0700
Subject: [PATCH] preserve docker configs other than credentials

---
 .github/workflows/ci.yml      | 14 +++++++++++---
 .github/workflows/nightly.yml | 14 +++++++++++---
 2 files changed, 22 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 694409d..4321f26 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -88,13 +88,21 @@ jobs:
           git lfs pull
 
       - name: Run E2E tests
-        # The GPU runners are shared. Use an empty job-temporary Docker config so
-        # stale credentials cannot override anonymous access to the public base image,
-        # and this job cannot modify the runner's persistent Docker login.
+        # The GPU runners are shared. Preserve their Docker client settings (for
+        # example proxy and buildx configuration) in a job-temporary copy, but
+        # remove all credential sources so stale logins cannot affect this job.
         env:
           DOCKER_CONFIG: ${{ runner.temp }}/isaac-autodata-docker
         run: |
           mkdir -p "${DOCKER_CONFIG}"
+          if [ -d "${HOME}/.docker" ]; then
+            cp -a "${HOME}/.docker/." "${DOCKER_CONFIG}/"
+          fi
+          if [ -f "${DOCKER_CONFIG}/config.json" ]; then
+            jq 'del(.auths, .credsStore, .credHelpers)' \
+              "${DOCKER_CONFIG}/config.json" > "${DOCKER_CONFIG}/config.sanitized.json"
+            mv "${DOCKER_CONFIG}/config.sanitized.json" "${DOCKER_CONFIG}/config.json"
+          fi
           ./scripts/ci/run_tests.sh
 
   build_docs:
diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index f652463..6ddfc33 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -60,13 +60,21 @@ jobs:
           git lfs pull
 
       - name: Run full E2E suite
-        # The GPU runners are shared. Use an empty job-temporary Docker config so
-        # stale credentials cannot override anonymous access to the public base image,
-        # and this job cannot modify the runner's persistent Docker login.
+        # The GPU runners are shared. Preserve their Docker client settings (for
+        # example proxy and buildx configuration) in a job-temporary copy, but
+        # remove all credential sources so stale logins cannot affect this job.
         env:
           DOCKER_CONFIG: ${{ runner.temp }}/isaac-autodata-docker
         run: |
           mkdir -p "${DOCKER_CONFIG}"
+          if [ -d "${HOME}/.docker" ]; then
+            cp -a "${HOME}/.docker/." "${DOCKER_CONFIG}/"
+          fi
+          if [ -f "${DOCKER_CONFIG}/config.json" ]; then
+            jq 'del(.auths, .credsStore, .credHelpers)' \
+              "${DOCKER_CONFIG}/config.json" > "${DOCKER_CONFIG}/config.sanitized.json"
+            mv "${DOCKER_CONFIG}/config.sanitized.json" "${DOCKER_CONFIG}/config.json"
+          fi
           ./scripts/ci/run_tests.sh
 
       - name: Test results summary