RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 1347805 - better error message when trying to pull from a integrate registry w/o being logged in.
Summary: better error message when trying to pull from a integrate registry w/o being ...
Keywords:
Status: CLOSED NOTABUG
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: docker
Version: 7.4
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: rc
: ---
Assignee: Antonio Murdaca
QA Contact: atomic-bugs@redhat.com
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2016-06-17 17:17 UTC by Peter Ruan
Modified: 2019-03-06 01:05 UTC (History)
2 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2016-10-23 13:42:06 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)

Description Peter Ruan 2016-06-17 17:17:21 UTC 
Description of problem:
  The error message when an unauthenticated user is trying to pull an image from an integrated registry is misleading.


Version-Release number of selected component (if applicable):
Docker version 1.10.3, build 02f13c2-unsupported

How reproducible:
always.

Steps to Reproduce:
1. create and push an image an authenticated user
2. logout as the user
3. do docker pull <uploaded_image>

Actual results:
[root@host-8-172-77 ~]# docker images
REPOSITORY                                                                            TAG                 IMAGE ID            CREATED             SIZE

172.30.116.116:5000/6rqgl/tc487929-busybox                                            local               47bcc53f74dc        3 months ago        1.113 MB
172.30.116.116:5000/oloay/tc487929-busybox                                            local               47bcc53f74dc        3 months ago        1.113 MB
172.30.116.116:5000/qp62u/tc487929-busybox                                            local               47bcc53f74dc        3 months ago        1.113 MB


[root@host-8-172-77 ~]# docker pull 172.30.116.116:5000/qp62u/tc487929-busybox:local
Trying to pull repository 172.30.116.116:5000/qp62u/tc487929-busybox ... 
Pulling repository 172.30.116.116:5000/qp62u/tc487929-busybox
Error: image qp62u/tc487929-busybox not found

Expected results:
docker should give the error that the user is denied access because of authentication issue.

Additional info:
Comment 2 Daniel Walsh 2016-08-19 22:41:58 UTC 
Shishir can I get an update on this?
Comment 3 Antonio Murdaca 2016-10-23 13:42:06 UTC 
This is how docker/distribution and docker works as of today. You get a 404, thus an image not found, not because the image isn't there but because docker first attempts to pull from a V2 registry, it gets unauthorized, tries to contact a V1 registry, the V1 registry doesn't exists, it gets back a 404 which is then translated to an image not found. What you get at the end of this "probing" is just the last error in the chain (the image not found).
There are lengthy issues upstream about this (opened by me https://github.com/docker/docker/issues/21054, https://github.com/docker/docker/issues/19834), none of those are feasible because of how docker is designed today, and this design won't easily change in the near future (it could cost a huge compatibility issue).

I'm closing this as not a bug.
Comment 4 Daniel Walsh 2016-10-24 11:57:10 UTC 
Is this worthy of a blog?  Just reference this bugzilla, talk about why this is and what it means.  Most of your content could be taken from the bugzilla.
Comment 5 Antonio Murdaca 2016-10-24 12:01:41 UTC 
I've already written about this in this skopeo issue also https://github.com/projectatomic/skopeo/issues/235#issuecomment-254820427

I've added to my todo list to write a blog post about this (it'll be really short though)
Note You need to log in before you can comment on or make changes to this bug.