From a7cf7eac0a6e81d79584ec016fe7663c176c5bfa Mon Sep 17 00:00:00 2001 From: Md_Mushfiqur Rahim <20mahin20201@gmail.com> Date: Mon, 25 May 2026 11:29:19 +0000 Subject: [PATCH] fix: propagate registry auth error in swarm image pull When a worker pull fails with unauthorized, the error was being swallowed and replaced with misleading 'No such image' message. Fix error propagation so the actual cause is reported. Signed-off-by: Md_Mushfiqur Rahim <20mahin20201@gmail.com> Signed-off-by: Sebastiaan van Stijn --- daemon/cluster/executor/container/controller.go | 8 ++++++++ daemon/internal/distribution/errors.go | 2 ++ 2 files changed, 10 insertions(+) diff --git a/daemon/cluster/executor/container/controller.go b/daemon/cluster/executor/container/controller.go index f531f042b0..eb1cb3db29 100644 --- a/daemon/cluster/executor/container/controller.go +++ b/daemon/cluster/executor/container/controller.go @@ -174,6 +174,14 @@ func (r *controller) Prepare(ctx context.Context) error { // If you don't want this behavior, lock down your image to an // immutable tag or digest. log.G(ctx).WithError(r.pullErr).Error("pulling image failed") + + // If the pull failed with an authentication error, return it + // so the actual cause is propagated instead of the misleading + // "No such image" error that would otherwise result from the + // container create below. + if cerrdefs.IsUnauthorized(r.pullErr) { + return r.pullErr + } } } } diff --git a/daemon/internal/distribution/errors.go b/daemon/internal/distribution/errors.go index 3154480ec8..76db31b8a0 100644 --- a/daemon/internal/distribution/errors.go +++ b/daemon/internal/distribution/errors.go @@ -106,6 +106,8 @@ func translatePullError(err error, ref reference.Named) error { switch v.Code { case errcode.ErrorCodeDenied, v2.ErrorCodeManifestUnknown, v2.ErrorCodeNameUnknown: return notFoundError{v, ref} + case errcode.ErrorCodeUnauthorized: + return errdefs.Unauthorized(v) } case xfer.DoNotRetry: return translatePullError(v.Err, ref)