Can't re-authenticate without stopping Docker container

[mahi2003]

After icloudpd recently stopped working for accounts with 2FA, I switched to kei. I really like it. Thank you for making this!

However, I can't figure out how to request and enter the 2FA code when running as Docker container. The wiki states to use following commands outside the container:

docker exec kei kei login get-code
docker exec -it kei kei login submit-code 123456

When I execute the first command, I get an error:

Error: Another kei instance is running for this account (lock: /config/.lock). If running in Docker, check for orphaned containers with docker ps and stop them with docker stop <name>.

I can stop the container and then use docker run to pass the command, but it is supposed to work without stopping the container. I am probably doing something stupid, but I don't see it...

[rhoopr]

Thanks for reporting this!

The error comes from the exclusive file lock that kei sync holds to protect session state. When the container starts, sync runs SRP authentication before it can detect that 2FA is needed. During that SRP handshake (a few seconds of network calls), the lock is held. Once sync sees that 2FA is required, it releases the lock and waits for you to run submit-code.

So there’s a timing window: if you run docker exec kei kei login get-code before sync finishes the SRP step, you’ll hit the lock error. Could you try waiting until you see a “2FA required” message in the container logs (docker logs kei) and then running the get-code command?

If it still fails after that, could you share your config.toml (with credentials redacted)? Specifically whether watch_with_interval is set, since that changes how the lock is held.

There is a watch mode edge case I'll be patching, but I don't think it's your current issue.

[rhoopr]

Fix is in #192, merging shortly.

Verified the race condition end-to-end in Docker. Timeline from the test:

14:53:32.322  [sync]     Starting kei
14:53:32.379  [get-code] Lock contention, retrying... attempt 1/6
14:53:35.380  [get-code] retrying... attempt 2/6
14:53:38.382  [get-code] retrying... attempt 3/6
14:53:39.245  [sync]     Authentication completed successfully
14:53:41.383  [get-code] retrying... attempt 4/6
14:53:44.385  [get-code] retrying... attempt 5/6 -- acquired lock
14:53:44.xxx  [get-code] "Session is already authenticated, 2FA is not required"
14:53:45.284  [sync]     downloaded=3, waiting before next cycle

docker exec kei kei login get-code now retries on lock contention (6 attempts, 3s apart) instead of failing immediately. During idle sleep the lock is released entirely, so get-code/submit-code acquire it without contention.

[mahi2003]

Thank you for your reply. I should mention that my 2FA was not yet expired. I just wanted to test whether the commands worked. I expected message "Session is already authenticated, 2FA is not required", but got "Another kei instance is running for this account". I assumed I had done something wrong.

[rhoopr]

Ahh, ok. Gotcha! So the code subcommands can be run at any time, you're basically forcing re-auth by doing that. I'll think about adding a check if we call get-code on an already-auth'd session.