diff --git a/cli/command/cli.go b/cli/command/cli.go
index 63397bf920..9ca28765cc 100644
--- a/cli/command/cli.go
+++ b/cli/command/cli.go
@@ -64,6 +64,15 @@ func (cli *DockerCli) ConfigFile() *configfile.ConfigFile {
 	return cli.configFile
 }
 
+// CredentialsStore returns a new credentials store based
+// on the settings provided in the configuration file.
+func (cli *DockerCli) CredentialsStore() credentials.Store {
+	if cli.configFile.CredentialsStore != "" {
+		return credentials.NewNativeStore(cli.configFile)
+	}
+	return credentials.NewFileStore(cli.configFile)
+}
+
 // Initialize the dockerCli runs initialization that must happen after command
 // line flags are parsed.
 func (cli *DockerCli) Initialize(opts *cliflags.ClientOptions) error {
diff --git a/cli/command/credentials.go b/cli/command/credentials.go
index 06e9d1de20..e4a4981458 100644
--- a/cli/command/credentials.go
+++ b/cli/command/credentials.go
@@ -13,13 +13,6 @@ func GetCredentials(c *configfile.ConfigFile, serverAddress string) (types.AuthC
 	return s.Get(serverAddress)
 }
 
-// GetAllCredentials loads all credentials from a credentials store.
-// The store is determined by the config file settings.
-func GetAllCredentials(c *configfile.ConfigFile) (map[string]types.AuthConfig, error) {
-	s := LoadCredentialsStore(c)
-	return s.GetAll()
-}
-
 // StoreCredentials saves the user credentials in a credentials store.
 // The store is determined by the config file settings.
 func StoreCredentials(c *configfile.ConfigFile, auth types.AuthConfig) error {
diff --git a/cli/command/image/build.go b/cli/command/image/build.go
index 06ee32ba83..7f59b54136 100644
--- a/cli/command/image/build.go
+++ b/cli/command/image/build.go
@@ -266,6 +266,7 @@ func runBuild(dockerCli *command.DockerCli, options buildOptions) error {
 		}
 	}
 
+	authConfig, _ := dockerCli.CredentialsStore().GetAll()
 	buildOptions := types.ImageBuildOptions{
 		Memory:         memory,
 		MemorySwap:     memorySwap,
@@ -286,7 +287,7 @@ func runBuild(dockerCli *command.DockerCli, options buildOptions) error {
 		ShmSize:        shmSize,
 		Ulimits:        options.ulimits.GetList(),
 		BuildArgs:      runconfigopts.ConvertKVStringsToMap(options.buildArgs.GetAll()),
-		AuthConfigs:    dockerCli.RetrieveAuthConfigs(),
+		AuthConfigs:    authConfig,
 		Labels:         runconfigopts.ConvertKVStringsToMap(options.labels),
 	}
 
diff --git a/cli/command/registry.go b/cli/command/registry.go
index 4f72afa4a1..65d8f3d8b9 100644
--- a/cli/command/registry.go
+++ b/cli/command/registry.go
@@ -20,6 +20,7 @@ import (
 )
 
 // ElectAuthServer returns the default registry to use (by asking the daemon)
+// TODO: only used in registry package and from ResolveAuthConfig
 func (cli *DockerCli) ElectAuthServer(ctx context.Context) string {
 	// The daemon `/info` endpoint informs us of the default registry being
 	// used. This is essential in cross-platforms environment, where for
@@ -35,6 +36,7 @@ func (cli *DockerCli) ElectAuthServer(ctx context.Context) string {
 }
 
 // EncodeAuthToBase64 serializes the auth configuration as JSON base64 payload
+// TODO: move to client/encode ?
 func EncodeAuthToBase64(authConfig types.AuthConfig) (string, error) {
 	buf, err := json.Marshal(authConfig)
 	if err != nil {
@@ -45,6 +47,7 @@ func EncodeAuthToBase64(authConfig types.AuthConfig) (string, error) {
 
 // RegistryAuthenticationPrivilegedFunc returns a RequestPrivilegeFunc from the specified registry index info
 // for the given command.
+// TODO: image/plugin
 func (cli *DockerCli) RegistryAuthenticationPrivilegedFunc(index *registrytypes.IndexInfo, cmdName string) types.RequestPrivilegeFunc {
 	return func() (string, error) {
 		fmt.Fprintf(cli.out, "\nPlease login prior to %s:\n", cmdName)
@@ -58,17 +61,10 @@ func (cli *DockerCli) RegistryAuthenticationPrivilegedFunc(index *registrytypes.
 	}
 }
 
-func (cli *DockerCli) promptWithDefault(prompt string, configDefault string) {
-	if configDefault == "" {
-		fmt.Fprintf(cli.out, "%s: ", prompt)
-	} else {
-		fmt.Fprintf(cli.out, "%s (%s): ", prompt, configDefault)
-	}
-}
-
 // ResolveAuthConfig is like registry.ResolveAuthConfig, but if using the
 // default index, it uses the default index name for the daemon's platform,
 // not the client's platform.
+// TODO: plugin/image/container and from RetrieveAuthTokenFromImage
 func (cli *DockerCli) ResolveAuthConfig(ctx context.Context, index *registrytypes.IndexInfo) types.AuthConfig {
 	configKey := index.Name
 	if index.Official {
@@ -79,13 +75,8 @@ func (cli *DockerCli) ResolveAuthConfig(ctx context.Context, index *registrytype
 	return a
 }
 
-// RetrieveAuthConfigs return all credentials.
-func (cli *DockerCli) RetrieveAuthConfigs() map[string]types.AuthConfig {
-	acs, _ := GetAllCredentials(cli.configFile)
-	return acs
-}
-
 // ConfigureAuth returns an AuthConfig from the specified user, password and server.
+// TODO: only used in registry package
 func (cli *DockerCli) ConfigureAuth(flUser, flPassword, serverAddress string, isDefaultRegistry bool) (types.AuthConfig, error) {
 	// On Windows, force the use of the regular OS stdin stream. Fixes #14336/#14210
 	if runtime.GOOS == "windows" {
@@ -154,21 +145,26 @@ func (cli *DockerCli) ConfigureAuth(flUser, flPassword, serverAddress string, is
 	return authconfig, nil
 }
 
-// resolveAuthConfigFromImage retrieves that AuthConfig using the image string
-func (cli *DockerCli) resolveAuthConfigFromImage(ctx context.Context, image string) (types.AuthConfig, error) {
-	registryRef, err := reference.ParseNamed(image)
+func readInput(in io.Reader, out io.Writer) string {
+	reader := bufio.NewReader(in)
+	line, _, err := reader.ReadLine()
 	if err != nil {
-		return types.AuthConfig{}, err
+		fmt.Fprintln(out, err.Error())
+		os.Exit(1)
 	}
-	repoInfo, err := registry.ParseRepositoryInfo(registryRef)
-	if err != nil {
-		return types.AuthConfig{}, err
+	return string(line)
+}
+
+func (cli *DockerCli) promptWithDefault(prompt string, configDefault string) {
+	if configDefault == "" {
+		fmt.Fprintf(cli.out, "%s: ", prompt)
+	} else {
+		fmt.Fprintf(cli.out, "%s (%s): ", prompt, configDefault)
 	}
-	authConfig := cli.ResolveAuthConfig(ctx, repoInfo.Index)
-	return authConfig, nil
 }
 
 // RetrieveAuthTokenFromImage retrieves an encoded auth token given a complete image
+// TODO: used in service/stack packages
 func (cli *DockerCli) RetrieveAuthTokenFromImage(ctx context.Context, image string) (string, error) {
 	// Retrieve encoded auth token from the image reference
 	authConfig, err := cli.resolveAuthConfigFromImage(ctx, image)
@@ -182,12 +178,16 @@ func (cli *DockerCli) RetrieveAuthTokenFromImage(ctx context.Context, image stri
 	return encodedAuth, nil
 }
 
-func readInput(in io.Reader, out io.Writer) string {
-	reader := bufio.NewReader(in)
-	line, _, err := reader.ReadLine()
+// resolveAuthConfigFromImage retrieves that AuthConfig using the image string
+func (cli *DockerCli) resolveAuthConfigFromImage(ctx context.Context, image string) (types.AuthConfig, error) {
+	registryRef, err := reference.ParseNamed(image)
 	if err != nil {
-		fmt.Fprintln(out, err.Error())
-		os.Exit(1)
+		return types.AuthConfig{}, err
 	}
-	return string(line)
+	repoInfo, err := registry.ParseRepositoryInfo(registryRef)
+	if err != nil {
+		return types.AuthConfig{}, err
+	}
+	authConfig := cli.ResolveAuthConfig(ctx, repoInfo.Index)
+	return authConfig, nil
 }