at-container-registry
A container registry that uses the AT Protocol for manifest storage and S3 for blob storage. atcr.io
docker container atproto go
Star 110
Fork 2
Watch

docker pull fails with "could not fetch content descriptor" for existing image #19

Closed evan.jarrett.net
Closed opened by evan.jarrett.net

I'm trying to use atcr.io/tangled.org/knot:v1.13.0-alpha (and latest) in a self-hosted server context. The image appears to exist — the registry web UI shows it with 107 pulls — but docker pull consistently fails.

Steps to reproduce #

# Login (works fine)
$ docker login atcr.io -u olamaelcu.net
Password:
Login Succeeded
# Pull fails
$ docker pull atcr.io/tangled.org/knot:v1.13.0-alpha
Error response from daemon: could not fetch content descriptor sha256:5672498fc6ae... not found
The same happens with latest:
$ docker pull atcr.io/tangled.org/knot:latest
Error response from daemon: could not fetch content descriptor sha256:0d1b2c3... not found

What I've tried #

  1. Anonymous pull — Same error before login
  2. Login with ATProto app password — docker login atcr.io -u with an app password works (Login Succeeded), but pull still fails with the same error
  3. Using the docker-credential-atcr helper — Installed v0.1.2 from releases, configured ~/.docker/config.json with {"credHelpers": {"atcr.io": "atcr"}}. The helper appears to authenticate (no error), but the pull still fails with the same content descriptor error
  4. Different network contexts — Same failure from my local machine and from the server (134.209.125.162 for reference in logs)
  5. Explicitly specifying the platform (--platform linux/amd64) — No difference

Environment #

  • Docker version: 27.x (both local and server)
  • OS: Debian (server), Debian (local)
  • docker-credential-atcr version: v0.1.2

Observations #

  • The registry web UI at https://atcr.io/tangled.org/knot shows the image and tag exists (107 pulls for v1.13.0-alpha and latest)
  • The content descriptor hash in the error (sha256:5672498fc6ae...) does not appear to match any content when inspected via the web UI
evan.jarrett.net

I do see you ran into a bug, but I am having trouble understanding what you did. You say "credential-helper" but that should be the oauth flow, not using an app-password. That should open a browser, or give you a url to sign in to the website and approve the connection.

My only other theory about this, was you were trying to use olamaelcu.net in terminal, but you were approving the auth signed in under omg.jacky.wtf.

The other bug I see is that if you never visit the website and log in, and you only use docker login with app-password, it wasn't granting you the proper access to pull images.

Either way, I've put a code check in place for this, and gave the olamaelcu.net access manually

BTW, my hosted solution at atcr.io doesn't support anonymous pulls currently.

jacky.wtf

I was aiming to use the app password because I was setting up tap via a container under Ansible: the browser flow would have been inaccessible to me. I did see that the hosted solution didn't support anon pulls - that's what led me to go with the auth pull.

I'll try this again shortly and report back, I appreciate you looking into this and apologize that the report wasn't terribly clear

Sign up or Sign in to add to the discussion.