Password protected mirror

[matejvasek]

Hello everyone,

I am trying to set up mirror for for registry to save bandwidth. The mirror is password protected.

I have config looking like this:

[[registry]]
location = "gcr.io"

[[registry.mirror]]
location = "registry.lan:5000" # the registry required uname/pwd

I am logged into registry.lan:5000 in both podman and docker (actual docker CLI).

All works nice and great when I use "containers tool" like podman or skopeo. So podman pull or skopeo copy do use the mirror and call it with apropriate credentials. No problems there.

However when I try to use podman as a docker daemon the registry is not called with the credentials. If I call docker pull (against podman daemon) the pull fails because credentials are not used send to the mirror.

The podman daemon out:

Apr 09 20:03:18 rigel podman[845743]: time="2025-04-09T20:03:18+02:00" level=warning msg="Failed, retrying in 1s ... (3/3). Error: initializing source docker://gcr.io/paketo-buildpacks/clojure-tools:2.15.0: (Mirrors also failed: [registry.lan:5000/paketo-buildpacks/clojure-tools:2.15.0: reading manifest 2.15.0 in registry.lan:5000/paketo-buildpacks/clojure-tools: authentication required]): gcr.io/paketo-buildpacks/clojure-tools:2.15.0: pinging container registry gcr.io: Get \"https://gcr.io/v2/\": dial tcp [2a00:XX:XX:XX::XX]:443: connect: connection refused"

The registry output:

Apr 09 20:03:18 rigel registry[454431]: time="2025-04-09T18:03:18.053054659Z" level=warning msg="error authorizing context: basic authentication challenge for realm "Registry-Realm": authentication failure" go.version=go1.20.8 http.request.host="registry.lan:5000" http.request.id=4ddb5663-a223-4f75-b50c-e0dc63adf3b4 http.request.method=GET http.request.remoteaddr="[2a02:XX:XX:XX:XX:XX:XX:XX]:38290" http.request.uri="/v2/paketo-buildpacks/clojure-tools/manifests/2.15.0" http.request.useragent="containers/5.34.0 (github.com/containers/image)" vars.name="paketo-buildpacks/clojure-tools" vars.reference=2.15.0 

Why is that? Is this a bug?

[vrothberg]

However when I try to use podman as a docker daemon the registry is not called with the credentials. If I call docker pull (against podman daemon) the pull fails because credentials are not used send to the mirror.

Are you sure that you did a docker login to the mirror before?

[matejvasek]

Yes I double checked now. I am logged in both via podman and docker.
However I think it should not even matter if I am logged in via docker.
The docker CLI probably should not even know there there is a mirroring set in the daemon. The daemon should inject these credentials IMO.

[matejvasek]

Maybe this is more of a feature request.

[matejvasek]

It appears this does not work in docker/moby either.