When a registry returns 403 Forbidden on a HEAD request (e.g., manifest
resolve or push existence check), the diagnostic error body is lost
because HEAD responses carry no body per HTTP spec. This leaves users
with an opaque "403 Forbidden" message and no actionable guidance.
Add a follow-up GET on HEAD 403 to retrieve the registry's OCI error
body. The existing unexpectedResponseErr machinery already parses the
body into structured errors — it just needs the body to be present. The
fallback lives in a shared withGETErrorBody helper used by both the
pusher and resolver: it only enriches when the GET also returns 403, and
preserves the original HEAD request's method and status while borrowing
just the body, so the resulting error's status and body stay consistent.
Scoped to 403 only because it is rare (CMK key disabled, IP firewall,
RBAC misconfiguration) and its body is highly diagnostic, while other
status codes either already use GET or have bodies that add no value.
Fixes#8969
Signed-off-by: Andrew Au <cshung@gmail.com>
Allow the last host to retry on transient network errors to incrase the
likelihood of the operation succeeding and help reduce flaky tests.
Signed-off-by: Derek McGowan <derek@mcg.dev>
The `push` function below assumes that digest and mediatypes are
populated and set. If they aren't, then the requests made are malformed,
attempting to invoke `HEAD /blobs/` (instead of `HEAD /blobs/<digest>`).
Additionally, if we *were* to move past this point, we'd then populate
an empty digest in the query parameter, and even provide invalid HTTP
mediatypes.
However, the `WithDescriptor` `WriterOpt` specifically notes that "Write
does not require any field of desc to be set". It's very easy for the
caller to read this as an optional field, to skip it, and then get
confusing HTTP errors from inside the `push` function.
We can avoid this by explicitly validating that the descriptor is valid
and provide early feedback.
Signed-off-by: Justin Chadwell <me@jedevc.com>
Error strings should not be capitalized (unless beginning with proper
nouns or acronyms) or end with punctuation, per Go style guide and
staticcheck ST1005.
This change lowercases the first letter of error messages in fmt.Errorf
calls throughout the codebase, while preserving uppercase for acronyms
at the start of error strings (e.g., NRI, RDT, CDI, UID, GID, VHD, FUSE).
Also fixes typo 'faild' -> 'failed' in resolver_test.go.
Changes:
- core/metadata: target.Digest, target.Size, target.MediaType
- core/remotes/docker: fetcher.Seek, fetcherByDigest
- integration: various test error messages
- internal/cri/server: containerConfig
- plugins/snapshots: erofs
Fixes#12011
Signed-off-by: Aadhar Agarwal <aadagarwal@microsoft.com>
This reverts commit 4bf1705a88.
This caused issues for downstream clients who were wrapping the type
contingent on it implementing io.ReaderAt.
Consequently this is causing headaches due to increased round trips with
the remote.
Meanwhile I only added this as a convenience for implementing
content.Provider in the remote which can done even without the original
change, just... less conveniently.
In hindsight, this was just a bad change as it has a rather wide impact
and the actual implementation isn't an optimized ReaderAt.
Signed-off-by: Brian Goff <cpuguy83@gmail.com>
If a host is configured that's different to the registry host namespace (e.g. a mirror), then
containerd will append the registry host namespace to requests as a query parameter called `ns`.
Set this query parameter on push requests for proxy mirror support.
Signed-off-by: Will Jordan <will.jordan@gmail.com>
Always attempt the fallback on hosts configured with the referrers
capability. Fallback for any non-404 error.
Signed-off-by: Derek McGowan <derek@mcg.dev>
This commit also adds an info-level log message for the case where the
registry doesn't send a digest header since the computed digest is a
valuable part of our content Commit interface.
Signed-off-by: Max Jonas Werner <max@coppersoft.com>
The distribution spec says this about the Docker-Content-Digest
header:
> These headers are OPTIONAL and clients SHOULD NOT depend on them
This commit changes the behaviour of the `dockerPusher` in a way that
makes it more compliant with that requirement in that it allows for it
to be missing from HTTP responses.
Signed-off-by: Max Jonas Werner <max@coppersoft.com>
Add condition for adding range header to avoid unnecessary header when
parallel pull is not being used. Some registries do not properly handle
the range header.
Signed-off-by: Derek McGowan <derek@mcg.dev>
Maksym Pavlenko