Answers: <p>This is actually how I got it working with &quot;ctr containerd.io 1.4.6&quot;.</p>
  <p><strong>ctr image pull --user &quot;myusername:mypasswd&quot; myurl.dot.com/docker_image:1.0.3</strong></p>
  <p>Hope it helps someone.</p>
  
Answers: CC BY-SA 4.0
Answers: 2022-10-05T11:22:57.750Z
Answers: 2022-10-05T11:22:57.750Z
Answers: GCF
Answers: <h1><code>docker.io/library/$IMAGE:$TAG</code></h1>
  <p>The problem here is simple the right syntax for <code>ctr</code> isn't <code>docker.io/alpine:latest</code> but <code>docker.io/library/alpine:latest</code> that should now work with <code>--creds &quot;evancarroll:$TOKEN&quot;</code> too.</p>
  <pre><code>ctr images pull docker.io/library/alpine:latest
  </code></pre>
  <h2>IRC logs</h2>
  <p>Thanks goes out to <code>larks</code> and <code>ada</code> on IRC <code>#docker</code> for helping out with this,</p>
  <blockquote>
  <p>larsks&gt; EvanCarroll: you probably need to include the tag there (<code>ctr images pull docker.io/library/alpine:latest</code>). The <code>/library</code> is there because that's the actual path to the image repository. There's some magic somewhere that transforms <code>docker.io/alpine</code> into <code>docker.io/library/alpine</code>; I don't know if that's client side or server side; ada will know  much more about that than I do.</p>
  </blockquote>
  <p>And thanks to <a href="https://github.com/distribution/distribution/blob/main/reference/normalize.go#L106" rel="nofollow noreferrer">@ada for showing where this is documented in the code</a>, and clarifying</p>
  <blockquote>
  <p>library/ is the namespace for all the top-level images on dockerhub with docker, that namespace is implied if you leave off the registry &amp; namespace part of the tag : <code>docker pull alpine</code> == <code>ctr images pull docker.io/library/alpine</code></p>
  </blockquote>
  
Answers: CC BY-SA 4.0
Answers: 2022-06-15T16:57:22.310Z
Answers: 2022-06-15T23:07:24.867Z
Answers: 2022-06-15T23:07:24.867Z
Answers: Evan Carroll
Body: <p>Authentication works on <code>crictl</code>, when I use <code>--creds</code></p>
  <pre class="lang-sh prettyprint-override"><code>$ sudo crictl pull --creds &quot;evancarroll:$TOKEN&quot; docker.io/alpine:3
  </code></pre>
  <p>But when I try the same command <code>ctr</code>, I get an error:</p>
  <pre><code>$ sudo ctr images pull --user &quot;evancarroll:$TOKEN&quot; docker.io/alpine:3
  docker.io/alpine:3: resolving
  INFO[0000] trying next host error=&quot;pull access denied, repository does not exist or may require authorization: server message: insufficient_scope: authorization failed&quot; host=registry-1.docker.io
  ctr: failed to resolve reference &quot;docker.io/alpine:3&quot;: pull access denied, repository does not exist or may require authorization: server message: insufficient_scope: authorization failed
  </code></pre>
  <hr />
  <p>You can see the <code>--http-dump --http-trace</code>,</p>
  <pre><code>$ sudo ctr images pull --http-dump --http-trace --user &quot;evancarroll:$TOKEN&quot; docker.io/alpine:3
  INFO[0000] HEAD /v2/alpine/manifests/3 HTTP/1.1
  INFO[0000] Host: registry-1.docker.io
  INFO[0000] Accept: application/vnd.docker.distribution.manifest.v2+json, application/vnd.docker.distribution.manifest.list.v2+json, application/vnd.oci.image.manifest.v1+json, application/vnd.oci.image.index.v1+json, */*
  INFO[0000] User-Agent: containerd/v1.5.11-k3s2
  INFO[0000]
  docker.io/alpine:3: resolving      |--------------------------------------|
  elapsed: 0.1 s      total:   0.0 B (0.0 B/s)
  INFO[0000] HTTP/1.1 401 Unauthorized
  INFO[0000] Content-Length: 149
  INFO[0000] Content-Type: application/json
  INFO[0000] Date: Wed, 15 Jun 2022 16:00:59 GMT
  INFO[0000] Docker-Distribution-Api-Version: registry/2.0
  INFO[0000] Strict-Transport-Security: max-age=31536000
  INFO[0000] Www-Authenticate: Bearer realm=&quot;https://auth.docker.io/token&quot;,service=&quot;registry.docker.io&quot;,scope=&quot;repository:alpine:pull&quot;
  INFO[0000]
  INFO[0000] POST /token HTTP/1.1
  INFO[0000] Host: auth.docker.io
  INFO[0000] Content-Type: application/x-www-form-urlencoded; charset=utf-8
  docker.io/alpine:3: resolving      |--------------------------------------|
  elapsed: 0.2 s      total:   0.0 B (0.0 B/s)
  INFO[0000] client_id=containerd-client&amp;grant_type=password&amp;password=HIDDEN&amp;scope=repository%3Aalpine%3Apull&amp;service=registry.docker.io&amp;username=evancarrollHTTP/1.1 200 OK
  INFO[0000] Transfer-Encoding: chunked
  INFO[0000] Content-Type: application/json; charset=utf-8
  INFO[0000] Date: Wed, 15 Jun 2022 16:00:59 GMT
  INFO[0000] Strict-Transport-Security: max-age=31536000
  INFO[0000] X-Trace-Id: 5da4dacdeb208ead79e15a59f83499b2
  INFO[0000]
  INFO[0000] 833
  INFO[0000] {&quot;access_token&quot;:&quot;HIDDEN&quot;,&quot;scope&quot;:&quot;&quot;,&quot;expires_in&quot;:300,&quot;issued_at&quot;:&quot;2022-06-15T16:00:59.464114622Z&quot;}
  INFO[0000]
  INFO[0000] 0
  INFO[0000]
  INFO[0000] HEAD /v2/alpine/manifests/3 HTTP/1.1
  INFO[0000] Host: registry-1.docker.io
  INFO[0000] Accept: application/vnd.docker.distribution.manifest.v2+json, application/vnd.docker.distribution.manifest.list.v2+json, application/vnd.oci.image.manifest.v1+json, application/vnd.oci.image.index.v1+json, */*
  INFO[0000] Authorization: Bearer HIDDEN
  docker.io/alpine:3: resolving      |--------------------------------------|
  elapsed: 0.3 s      total:   0.0 B (0.0 B/s)
  INFO[0000] HTTP/1.1 401 Unauthorized
  INFO[0000] Content-Length: 149
  INFO[0000] Content-Type: application/json
  INFO[0000] Date: Wed, 15 Jun 2022 16:00:59 GMT
  INFO[0000] Docker-Distribution-Api-Version: registry/2.0
  INFO[0000] Strict-Transport-Security: max-age=31536000
  INFO[0000] Www-Authenticate: Bearer realm=&quot;https://auth.docker.io/token&quot;,service=&quot;registry.docker.io&quot;,scope=&quot;repository:alpine:pull&quot;,error=&quot;insufficient_scope&quot;
  INFO[0000]
  INFO[0000] trying next host error=&quot;pull access denied, repository does not exist or may require authorization: server message: insufficient_scope: authorization failed&quot; host=registry-1.docker.io
  ctr: failed to resolve reference &quot;docker.io/alpine:3&quot;: pull access denied, repository does not exist or may require authorization: server message: insufficient_scope: authorization failed
  </code></pre>
  
Comments: CC BY-SA 4.0
Comments: 2023-11-24T16:10:55.140Z
Comments: I am using the similiar command but did not work. `crictl pull --creds "jiangch:$789" registry.cn-shanghai.aliyuncs.com/reddwarf-pro/dolphin-post:a56ae
  FATA[0000] pulling image: rpc error: code = Unknown desc = failed to pull and unpack image "registry.cn-shanghai.aliyuncs.com/reddwarf-pro/dolphin-post:a56ae": failed to resolve reference "registry.cn-shanghai.aliyuncs.com/reddwarf-pro/dolphin-post:a56ae": pull access denied, repository does not exist or may require authorization: server message: insufficient_scope: authorization failed`
Comments: Dolphin
Tags: <dockerhub><authentication><containerd>
Title: Can not authenticate to DockerHub docker.io with ctr; works fine with crictl
UserDisplayName: Evan Carroll
ThreadText: # Can not authenticate to DockerHub docker.io with ctr; works fine with crictl
  
  (Asked by: username_0 on 2022-06-15)
  
  Authentication works on `crictl`, when I use `--creds`
  
  ```sh
  $ sudo crictl pull --creds "username_0:$TOKEN" docker.io/alpine:3
  
  ```
  
  But when I try the same command `ctr`, I get an error:
  
  ```
  $ sudo ctr images pull --user "username_0:$TOKEN" docker.io/alpine:3
  docker.io/alpine:3: resolving
  INFO[0000] trying next host error="pull access denied, repository does not exist or may require authorization: server message: insufficient_scope: authorization failed" host=registry-1.docker.io
  ctr: failed to resolve reference "docker.io/alpine:3": pull access denied, repository does not exist or may require authorization: server message: insufficient_scope: authorization failed
  
  ```
  
  ---
  
  You can see the `--http-dump --http-trace`,
  
  ```
  $ sudo ctr images pull --http-dump --http-trace --user "username_0:$TOKEN" docker.io/alpine:3
  INFO[0000] HEAD /v2/alpine/manifests/3 HTTP/1.1
  INFO[0000] Host: registry-1.docker.io
  INFO[0000] Accept: application/vnd.docker.distribution.manifest.v2+json, application/vnd.docker.distribution.manifest.list.v2+json, application/vnd.oci.image.manifest.v1+json, application/vnd.oci.image.index.v1+json, */*
  INFO[0000] User-Agent: containerd/v1.5.11-k3s2
  INFO[0000]
  docker.io/alpine:3: resolving      |--------------------------------------|
  elapsed: 0.1 s      total:   0.0 B (0.0 B/s)
  INFO[0000] HTTP/1.1 401 Unauthorized
  INFO[0000] Content-Length: 149
  INFO[0000] Content-Type: application/json
  INFO[0000] Date: Wed, 15 Jun 2022 16:00:59 GMT
  INFO[0000] Docker-Distribution-Api-Version: registry/2.0
  INFO[0000] Strict-Transport-Security: max-age=31536000
  INFO[0000] Www-Authenticate: Bearer realm="https://auth.docker.io/token",service="registry.docker.io",scope="repository:alpine:pull"
  INFO[0000]
  INFO[0000] POST /token HTTP/1.1
  INFO[0000] Host: auth.docker.io
  INFO[0000] Content-Type: application/x-www-form-urlencoded; charset=utf-8
  docker.io/alpine:3: resolving      |--------------------------------------|
  elapsed: 0.2 s      total:   0.0 B (0.0 B/s)
  INFO[0000] client_id=containerd-client&grant_type=password&password=HIDDEN&scope=repository%3Aalpine%3Apull&service=registry.docker.io&username=evancarrollHTTP/1.1 200 OK
  INFO[0000] Transfer-Encoding: chunked
  INFO[0000] Content-Type: application/json; charset=utf-8
  INFO[0000] Date: Wed, 15 Jun 2022 16:00:59 GMT
  INFO[0000] Strict-Transport-Security: max-age=31536000
  INFO[0000] X-Trace-Id: 5da4dacdeb208ead79e15a59f83499b2
  INFO[0000]
  INFO[0000] 833
  INFO[0000] {"access_token":"HIDDEN","scope":"","expires_in":300,"issued_at":"2022-06-15T16:00:59.464114622Z"}
  INFO[0000]
  INFO[0000] 0
  INFO[0000]
  INFO[0000] HEAD /v2/alpine/manifests/3 HTTP/1.1
  INFO[0000] Host: registry-1.docker.io
  INFO[0000] Accept: application/vnd.docker.distribution.manifest.v2+json, application/vnd.docker.distribution.manifest.list.v2+json, application/vnd.oci.image.manifest.v1+json, application/vnd.oci.image.index.v1+json, */*
  INFO[0000] Authorization: Bearer HIDDEN
  docker.io/alpine:3: resolving      |--------------------------------------|
  elapsed: 0.3 s      total:   0.0 B (0.0 B/s)
  INFO[0000] HTTP/1.1 401 Unauthorized
  INFO[0000] Content-Length: 149
  INFO[0000] Content-Type: application/json
  INFO[0000] Date: Wed, 15 Jun 2022 16:00:59 GMT
  INFO[0000] Docker-Distribution-Api-Version: registry/2.0
  INFO[0000] Strict-Transport-Security: max-age=31536000
  INFO[0000] Www-Authenticate: Bearer realm="https://auth.docker.io/token",service="registry.docker.io",scope="repository:alpine:pull",error="insufficient_scope"
  INFO[0000]
  INFO[0000] trying next host error="pull access denied, repository does not exist or may require authorization: server message: insufficient_scope: authorization failed" host=registry-1.docker.io
  ctr: failed to resolve reference "docker.io/alpine:3": pull access denied, repository does not exist or may require authorization: server message: insufficient_scope: authorization failed
  
  ```
  
  **Tags:** dockerhub, authentication, containerd
  
  > **Comments:**
  > **username_1**: I am using the similiar command but did not work. `crictl pull --creds "jiangch:$789" registry.cn-shanghai.aliyuncs.com/reddwarf-pro/username_1-post:a56ae FATA[0000] pulling image: rpc error: code = Unknown desc = failed to pull and unpack image "registry.cn-shanghai.aliyuncs.com/reddwarf-pro/username_1-post:a56ae": failed to resolve reference "registry.cn-shanghai.aliyuncs.com/reddwarf-pro/username_1-post:a56ae": pull access denied, repository does not exist or may require authorization: server message: insufficient_scope: authorization failed`  
  
  ---
  
  ## 2 answers
  
  ### Answer by username_0 on 2022-06-15. Score: 3 | Accepted answer
  
  # `docker.io/library/$IMAGE:$TAG`
  
  The problem here is simple the right syntax for `ctr` isn't `docker.io/alpine:latest` but `docker.io/library/alpine:latest` that should now work with `--creds "username_0:$TOKEN"` too.
  
  ```
  ctr images pull docker.io/library/alpine:latest
  
  ```
  
  ## IRC logs
  
  Thanks goes out to `larks` and `ada` on IRC `#docker` for helping out with this,
  
  > larsks> username_0: you probably need to include the tag there (`ctr images pull docker.io/library/alpine:latest`). The `/library` is there because that's the actual path to the image repository. There's some magic somewhere that transforms `docker.io/alpine` into `docker.io/library/alpine`; I don't know if that's client side or server side; ada will know much more about that than I do.
  
  And thanks to [@ada for showing where this is documented in the code](https://github.com/distribution/distribution/blob/main/reference/normalize.go#L106), and clarifying
  
  > library/ is the namespace for all the top-level images on dockerhub with docker, that namespace is implied if you leave off the registry & namespace part of the tag : `docker pull alpine` == `ctr images pull docker.io/library/alpine`
  
  
  ---
  
  ### Answer by username_2 on 2022-10-05. Score: 1
  
  This is actually how I got it working with "ctr containerd.io 1.4.6".
  
  **ctr image pull --user "myusername:mypasswd" myurl.dot.com/docker\_image:1.0.3**
  
  Hope it helps someone.
  
  
  ---
  
  