From c4266ecbbfb0f5633226b7bbc609e398e9cb27a8 Mon Sep 17 00:00:00 2001
From: Saadi Myftija <saadi@myftija.com>
Date: Tue, 8 Sep 2026 15:26:10 +0200
Subject: [PATCH] fix(cli): keep docker login output out of build logs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The registry login step's output was collected into the shared build log
buffer, so build logs on self-hosted and local builds always carried
docker's unencrypted-credentials warning — most confusingly right next to
the real error on failed builds. Route login output to debug logging only,
push a single 'Logged in to <registry>' marker into the build log on
success, and keep returning the full login output when the login itself
fails.
---
 .changeset/dry-mirrors-shake.md          |  5 +++++
 packages/cli-v3/src/deploy/buildImage.ts | 10 ++++++++--
 2 files changed, 13 insertions(+), 2 deletions(-)
 create mode 100644 .changeset/dry-mirrors-shake.md

diff --git a/.changeset/dry-mirrors-shake.md b/.changeset/dry-mirrors-shake.md
new file mode 100644
index 00000000000..fc0c47f493a
--- /dev/null
+++ b/.changeset/dry-mirrors-shake.md
@@ -0,0 +1,5 @@
+---
+"trigger.dev": patch
+---
+
+Build logs no longer include docker's registry login output, most notably the credential-storage warning on failed builds.
diff --git a/packages/cli-v3/src/deploy/buildImage.ts b/packages/cli-v3/src/deploy/buildImage.ts
index 37990af2591..f173b2f01a7 100644
--- a/packages/cli-v3/src/deploy/buildImage.ts
+++ b/packages/cli-v3/src/deploy/buildImage.ts
@@ -514,8 +514,12 @@ async function localBuildImage(options: SelfHostedBuildImageOptions): Promise<Bu
     loginProcess.process?.stdin?.write(credentials.password);
     loginProcess.process?.stdin?.end();
 
+    // Login output (incl. docker's credential-storage warning) stays out of the build
+    // logs; it is fully visible at debug level and returned when the login itself fails.
+    const loginLogs: string[] = [];
+
     for await (const line of loginProcess) {
-      errors.push(line);
+      loginLogs.push(line);
       logger.debug(line);
     }
 
@@ -523,10 +527,12 @@ async function localBuildImage(options: SelfHostedBuildImageOptions): Promise<Bu
       return {
         ok: false as const,
         error: `Failed to login to registry: ${cloudRegistryHost}`,
-        logs: extractLogs(errors),
+        logs: extractLogs(loginLogs),
       };
     }
 
+    // `errors` is the shared build log buffer; keep a marker there so failure logs show auth ran
+    errors.push(`Logged in to ${cloudRegistryHost}`);
     options.onLog?.(`Successfully logged in to the remote registry`);
   }