docker pull unauthenticated

[Pimmetje]

Version
docker image: 2.24.1

Describe the bug
I have setup pulp in order to use it as Pull-Through Caching server for containers.
If u authenticate as admin by putting the base64 username:password in the docker config it works.
If i try to pull a already pulled image without authentication it does not work.

To Reproduce
I can pull docker image using docker when i put the base64 authentication in the config. But without authentication it does not work (token disabled)
Without credentials i get "Error response from daemon: Head https://<server>/v2/docker-cache/gitlab/gitlab-ce/manifests/17.9.3-ce.0 no basic auth credentials"

Expected behavior
Ability to pull unauthenticated the container using docker.

Additional context
pulp-dev: gerrod:
Right now our non-token auth code is setup based on how podman works. A logout podman will send the auth header Basic Og== which we use to specify an anonymous user. Docker on the other hand will send no auth header and when it requests the /v2/ endpoint it hits the 401 error because that endpoint expects atleast an anon user.

We should probably just change this hardcoded line: https://github.com/pulp/pulp_container/blob/main/pulp_container/app/registry_api.py#L474

[ajaincdsc]

Is this being worked on? Is there a mitigation we can use? We're experiencing the same issue, and transitioning to podman across our infrastructure is not an option

Edit: We ended up deploying Harbor for a variety of reasons

[am9zZWY]

We are looking for a drop in replacement for Sonatype Nexus. Nexus supports unauthenticated pulls. The only way we found in pulp with the pull-through container distribution was to create a user with the container.containerpullthroughdistribution_consumer role on the distribution and the container.containernamespace_consumer role on the namespace.

variable "anon_password" {
  type      = string
  sensitive = true
  default   = "ebeb1881"
}

resource "pulp_user" "anon" {
  username = "anon"
  password = var.anon_password
}

resource "pulp_object_role" "anon_pullthrough" {
  pulp_href = pulp_distribution.distribution["docker"].pulp_href
  role      = "container.containerpullthroughdistribution_consumer"
  users     = [pulp_user.anon.username]
}

resource "pulp_object_role" "anon_namespace" {
  pulp_href = pulp_distribution.distribution["docker"].namespace
  role      = "container.containernamespace_consumer"
  users     = [pulp_user.anon.username]
}