Here's an example:

- task: build-auth
    config:
      platform: linux
      image_resource:
        type: registry-image
        source:
          repository: ubuntu
          tag: focal
      outputs:
      - name: docker-creds
      params:
        DOCKER_REGISTRY: "dev.registry.pivotal.io"
        DOCKER_USERNAME: ((tanzu-registry.username))
        DOCKER_PASSWORD: ((tanzu-registry.password))
      run:
        path: bash
        args:
        - -c
        - |
          AUTH="$(echo -n "${DOCKER_USERNAME}:${DOCKER_PASSWORD}" | base64 -w 0)"
          cat > docker-creds/config.json <<EOF
          { "auths": { "${DOCKER_REGISTRY}": { "auth": "$AUTH" }}}
          EOF
  - task: build
    privileged: true
    config:
      platform: linux
      image_resource:
        type: registry-image
        source:
          repository: vito/oci-build-task
      inputs:
      - name: source
      - name: docker-creds
      outputs:
      - name: image
      params:
        DOCKER_CONFIG: docker-creds
        CONTEXT: source
      run:
        path: build

We might want to put the json in credhub already encoded.

Comment From: philwebb

Also https://github.com/vito/oci-build-task/pull/40#issuecomment-732205486 is similar