[Bug]: Running `container image push` after `container registry login` requires keychain access

[ostenbom]

I have done the following

• I have searched the existing issues
• If possible, I've reproduced the issue using the 'main' branch of this project

Steps to reproduce

After container registry login, trying to push that image requires keychain access.

The keychain entry is made for the container appliation, but container-core-images requires access to the keychain item to run.

Current behavior

Popup dialogue container-core-images is requesting access to the xxx secret

Having keychain ask every time is inconvenient when scripting and needing to re login to the registry every 12 hours with AWS ECR.

Clicking allow all is possible - but when using short lived credentials doesn't help since the credential gets re-made on each registry login

Expected behavior

The container application already has access to the keychain item, so it would be great if container-core-images also had access by default.

Environment

- OS: macOS 26.2
- Xcode: Version 26.2
- Container: 0.9.0

Relevant log output

N/A

Code of Conduct

• I agree to follow this project's Code of Conduct

[ostenbom]

Relevant PR fix(registry): grant keychain access to images plugin (#816), but is a little stale. Created the issue to help track.

[jglogan]

@ostenbom Would this be a duplicate of what's being asked for in #820?

[ostenbom]

@jglogan if that was done then it would solve the problem in another way for sure! But this is still a separate bug that says "it would be nice if the default credential helper was easier to use / didn't cause unexpected keychain popup dialogues".

[jglogan]

Agreed. I have an idea about this, going to assign myself for a possible fix.

[jglogan]

@ostenbom Unfortunately a keychain-access-group entitlement isn't possible the way we package the software today.

It may still make sense to merge the PRs I posted as they're a natural extension of our APIs and could be useful in the future, but for your issue, it seems that adding the credential helper capability is the more practical approach.