Container registry (docker) ask credential for pull

[PavelMXFox]

Description

Hello! I have public organization with public repo. In this org i have docker (containes) package. If i do docker login - i can pull it, if if don't - Error response from daemon: Head "XXXXXXXX": no basic auth credentials. But i can see this package's page in gitea without any auth.

Gitea Version

1.17.0+dev-511-g71bafa026

Can you reproduce the bug on the Gitea demo site?

No

Log Gist

No response

Screenshots

No response

Git Version

No response

Operating System

No response

How are you running Gitea?

Using docker image: gitea/gitea:dev

Database

MySQL

[UnlimitedCookies]

I am experiencing the same issue. Might be worth to ping @KN4CK3R as he's the author.
The following endpoint requires to be signed in, while the package should be public:
Head "https://gitea.example.com/v2/{owner}/{package}/manifests/{tag}": no basic auth credentials

Currently, I would expect all packages to be public (as they're visible in the GUI), but the addition of private packages in the future would be useful nevertheless.

[KN4CK3R]

That's normal behaviour even for public packages. The spec says:

If a 401 Unauthorized response is returned, the client should take action based on the contents of the “WWW-Authenticate” header and try the endpoint again.

It works like this if you use the official docker registry too:

HEAD https://registry.docker.com/v2/gitea/gitea/manifests/latest

content-type: application/json
docker-distribution-api-version: registry/2.0
www-authenticate: Bearer realm="https://auth.docker.io/token",service="registry.docker.io",scope="repository:gitea/gitea:pull"
date: Tue, 17 May 2022 05:20:03 GMT
content-length: 154
strict-transport-security: max-age=31536000

GET https://auth.docker.io/token?service=registry.docker.io&scope=repository:gitea/gitea:pull

content-type: application/json; charset=utf-8
date: Tue, 17 May 2022 05:24:26 GMT
transfer-encoding: chunked
strict-transport-security: max-age=31536000
{
  "token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXV...",
  "access_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsIng1YyI6W...",
  "expires_in": 300,
  "issued_at": "2022-05-17T05:24:26.283390798Z"
}

HEAD https://registry.docker.com/v2/gitea/gitea/manifests/latest
Authorization: Bearer eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXV...

content-length: 12647
content-type: application/vnd.docker.distribution.manifest.v1+prettyjws
docker-content-digest: sha256:64393d1820234a2117156b0703a32f5ba685c283797350046e071673304e9c18
docker-distribution-api-version: registry/2.0
etag: "sha256:64393d1820234a2117156b0703a32f5ba685c283797350046e071673304e9c18"
date: Tue, 17 May 2022 05:28:01 GMT
strict-transport-security: max-age=31536000
ratelimit-limit: 100;w=21600
ratelimit-remaining: 100;w=21600

If you really login you need to pass BasicAuth to the the GET .../token request.

[PavelMXFox]

It 's not quite like that - when I do docker pull gitea/gitea without docker login i can pull this public image from official dockerhub whitout any additional actions. If i nee to pull protected image - i need exec docker login.

When i pull public image from my own gitea - it says no basic auth credentials and i neel to login.
When i pulling image without auth from my own another registry (deployed from official docker'sregistry image) - no any additional auth needed.

[KN4CK3R]

Thank you for clarification. Looks like the official Docker client does not like multiple WWW-Authenticate headers.
Fix is in #19735.

[PavelMXFox]

Hi! I updated now my gitea to 1.17.0+dev-587-g9ea920640 and when try docker pull from public repos, receive Error response from daemon: unauthorized: authentication required.
I can see this public image's page in gitea UI without any auth and can pull it after docker login.