<p>This is actually how I got it working with &quot;ctr containerd.io 1.4.6&quot;.</p>
<p><strong>ctr image pull --user &quot;myusername:mypasswd&quot; myurl.dot.com/docker_image:1.0.3</strong></p>
<p>Hope it helps someone.</p>

CC BY-SA 4.0
2022-10-05T11:22:57.750Z
2022-10-05T11:22:57.750Z
GCF
<h1><code>docker.io/library/$IMAGE:$TAG</code></h1>
<p>The problem here is simple the right syntax for <code>ctr</code> isn't <code>docker.io/alpine:latest</code> but <code>docker.io/library/alpine:latest</code> that should now work with <code>--creds &quot;evancarroll:$TOKEN&quot;</code> too.</p>
<pre><code>ctr images pull docker.io/library/alpine:latest
</code></pre>
<h2>IRC logs</h2>
<p>Thanks goes out to <code>larks</code> and <code>ada</code> on IRC <code>#docker</code> for helping out with this,</p>
<blockquote>
<p>larsks&gt; EvanCarroll: you probably need to include the tag there (<code>ctr images pull docker.io/library/alpine:latest</code>). The <code>/library</code> is there because that's the actual path to the image repository. There's some magic somewhere that transforms <code>docker.io/alpine</code> into <code>docker.io/library/alpine</code>; I don't know if that's client side or server side; ada will know  much more about that than I do.</p>
</blockquote>
<p>And thanks to <a href="https://github.com/distribution/distribution/blob/main/reference/normalize.go#L106" rel="nofollow noreferrer">@ada for showing where this is documented in the code</a>, and clarifying</p>
<blockquote>
<p>library/ is the namespace for all the top-level images on dockerhub with docker, that namespace is implied if you leave off the registry &amp; namespace part of the tag : <code>docker pull alpine</code> == <code>ctr images pull docker.io/library/alpine</code></p>
</blockquote>

CC BY-SA 4.0
2022-06-15T16:57:22.310Z
2022-06-15T23:07:24.867Z
2022-06-15T23:07:24.867Z
Evan Carroll
<p>Authentication works on <code>crictl</code>, when I use <code>--creds</code></p>
<pre class="lang-sh prettyprint-override"><code>$ sudo crictl pull --creds &quot;evancarroll:$TOKEN&quot; docker.io/alpine:3
</code></pre>
<p>But when I try the same command <code>ctr</code>, I get an error:</p>
<pre><code>$ sudo ctr images pull --user &quot;evancarroll:$TOKEN&quot; docker.io/alpine:3
docker.io/alpine:3: resolving
INFO[0000] trying next host error=&quot;pull access denied, repository does not exist or may require authorization: server message: insufficient_scope: authorization failed&quot; host=registry-1.docker.io
ctr: failed to resolve reference &quot;docker.io/alpine:3&quot;: pull access denied, repository does not exist or may require authorization: server message: insufficient_scope: authorization failed
</code></pre>
<hr />
<p>You can see the <code>--http-dump --http-trace</code>,</p>
<pre><code>$ sudo ctr images pull --http-dump --http-trace --user &quot;evancarroll:$TOKEN&quot; docker.io/alpine:3
INFO[0000] HEAD /v2/alpine/manifests/3 HTTP/1.1
INFO[0000] Host: registry-1.docker.io
INFO[0000] Accept: application/vnd.docker.distribution.manifest.v2+json, application/vnd.docker.distribution.manifest.list.v2+json, application/vnd.oci.image.manifest.v1+json, application/vnd.oci.image.index.v1+json, */*
INFO[0000] User-Agent: containerd/v1.5.11-k3s2
INFO[0000]
docker.io/alpine:3: resolving      |--------------------------------------|
elapsed: 0.1 s      total:   0.0 B (0.0 B/s)
INFO[0000] HTTP/1.1 401 Unauthorized
INFO[0000] Content-Length: 149
INFO[0000] Content-Type: application/json
INFO[0000] Date: Wed, 15 Jun 2022 16:00:59 GMT
INFO[0000] Docker-Distribution-Api-Version: registry/2.0
INFO[0000] Strict-Transport-Security: max-age=31536000
INFO[0000] Www-Authenticate: Bearer realm=&quot;https://auth.docker.io/token&quot;,service=&quot;registry.docker.io&quot;,scope=&quot;repository:alpine:pull&quot;
INFO[0000]
INFO[0000] POST /token HTTP/1.1
INFO[0000] Host: auth.docker.io
INFO[0000] Content-Type: application/x-www-form-urlencoded; charset=utf-8
docker.io/alpine:3: resolving      |--------------------------------------|
elapsed: 0.2 s      total:   0.0 B (0.0 B/s)
INFO[0000] client_id=containerd-client&amp;grant_type=password&amp;password=HIDDEN&amp;scope=repository%3Aalpine%3Apull&amp;service=registry.docker.io&amp;username=evancarrollHTTP/1.1 200 OK
INFO[0000] Transfer-Encoding: chunked
INFO[0000] Content-Type: application/json; charset=utf-8
INFO[0000] Date: Wed, 15 Jun 2022 16:00:59 GMT
INFO[0000] Strict-Transport-Security: max-age=31536000
INFO[0000] X-Trace-Id: 5da4dacdeb208ead79e15a59f83499b2
INFO[0000]
INFO[0000] 833
INFO[0000] {&quot;access_token&quot;:&quot;HIDDEN&quot;,&quot;scope&quot;:&quot;&quot;,&quot;expires_in&quot;:300,&quot;issued_at&quot;:&quot;2022-06-15T16:00:59.464114622Z&quot;}
INFO[0000]
INFO[0000] 0
INFO[0000]
INFO[0000] HEAD /v2/alpine/manifests/3 HTTP/1.1
INFO[0000] Host: registry-1.docker.io
INFO[0000] Accept: application/vnd.docker.distribution.manifest.v2+json, application/vnd.docker.distribution.manifest.list.v2+json, application/vnd.oci.image.manifest.v1+json, application/vnd.oci.image.index.v1+json, */*
INFO[0000] Authorization: Bearer HIDDEN
docker.io/alpine:3: resolving      |--------------------------------------|
elapsed: 0.3 s      total:   0.0 B (0.0 B/s)
INFO[0000] HTTP/1.1 401 Unauthorized
INFO[0000] Content-Length: 149
INFO[0000] Content-Type: application/json
INFO[0000] Date: Wed, 15 Jun 2022 16:00:59 GMT
INFO[0000] Docker-Distribution-Api-Version: registry/2.0
INFO[0000] Strict-Transport-Security: max-age=31536000
INFO[0000] Www-Authenticate: Bearer realm=&quot;https://auth.docker.io/token&quot;,service=&quot;registry.docker.io&quot;,scope=&quot;repository:alpine:pull&quot;,error=&quot;insufficient_scope&quot;
INFO[0000]
INFO[0000] trying next host error=&quot;pull access denied, repository does not exist or may require authorization: server message: insufficient_scope: authorization failed&quot; host=registry-1.docker.io
ctr: failed to resolve reference &quot;docker.io/alpine:3&quot;: pull access denied, repository does not exist or may require authorization: server message: insufficient_scope: authorization failed
</code></pre>

CC BY-SA 4.0
2023-11-24T16:10:55.140Z
I am using the similiar command but did not work. `crictl pull --creds "jiangch:$789" registry.cn-shanghai.aliyuncs.com/reddwarf-pro/dolphin-post:a56ae
FATA[0000] pulling image: rpc error: code = Unknown desc = failed to pull and unpack image "registry.cn-shanghai.aliyuncs.com/reddwarf-pro/dolphin-post:a56ae": failed to resolve reference "registry.cn-shanghai.aliyuncs.com/reddwarf-pro/dolphin-post:a56ae": pull access denied, repository does not exist or may require authorization: server message: insufficient_scope: authorization failed`
Dolphin
<dockerhub><authentication><containerd>
Can not authenticate to DockerHub docker.io with ctr; works fine with crictl
Evan Carroll
# Can not authenticate to DockerHub docker.io with ctr; works fine with crictl

(Asked by: username_0 on 2022-06-15)

Authentication works on crictl, when I use --creds
$ sudo crictl pull --creds "evancarroll:$TOKEN" docker.io/alpine:3

But when I try the same command ctr, I get an error:
$ sudo ctr images pull --user "evancarroll:$TOKEN" docker.io/alpine:3
docker.io/alpine:3: resolving
INFO[0000] trying next host error="pull access denied, repository does not exist or may require authorization: server message: insufficient_scope: authorization failed" host=registry-1.docker.io
ctr: failed to resolve reference "docker.io/alpine:3": pull access denied, repository does not exist or may require authorization: server message: insufficient_scope: authorization failed


You can see the --http-dump --http-trace,
$ sudo ctr images pull --http-dump --http-trace --user "evancarroll:$TOKEN" docker.io/alpine:3
INFO[0000] HEAD /v2/alpine/manifests/3 HTTP/1.1
INFO[0000] Host: registry-1.docker.io
INFO[0000] Accept: application/vnd.docker.distribution.manifest.v2+json, application/vnd.docker.distribution.manifest.list.v2+json, application/vnd.oci.image.manifest.v1+json, application/vnd.oci.image.index.v1+json, */*
INFO[0000] User-Agent: containerd/v1.5.11-k3s2
INFO[0000]
docker.io/alpine:3: resolving      |--------------------------------------|
elapsed: 0.1 s      total:   0.0 B (0.0 B/s)
INFO[0000] HTTP/1.1 401 Unauthorized
INFO[0000] Content-Length: 149
INFO[0000] Content-Type: application/json
INFO[0000] Date: Wed, 15 Jun 2022 16:00:59 GMT
INFO[0000] Docker-Distribution-Api-Version: registry/2.0
INFO[0000] Strict-Transport-Security: max-age=31536000
INFO[0000] Www-Authenticate: Bearer realm="https://auth.docker.io/token",service="registry.docker.io",scope="repository:alpine:pull"
INFO[0000]
INFO[0000] POST /token HTTP/1.1
INFO[0000] Host: auth.docker.io
INFO[0000] Content-Type: application/x-www-form-urlencoded; charset=utf-8
docker.io/alpine:3: resolving      |--------------------------------------|
elapsed: 0.2 s      total:   0.0 B (0.0 B/s)
INFO[0000] client_id=containerd-client&grant_type=password&password=HIDDEN&scope=repository%3Aalpine%3Apull&service=registry.docker.io&username=evancarrollHTTP/1.1 200 OK
INFO[0000] Transfer-Encoding: chunked
INFO[0000] Content-Type: application/json; charset=utf-8
INFO[0000] Date: Wed, 15 Jun 2022 16:00:59 GMT
INFO[0000] Strict-Transport-Security: max-age=31536000
INFO[0000] X-Trace-Id: 5da4dacdeb208ead79e15a59f83499b2
INFO[0000]
INFO[0000] 833
INFO[0000] {"access_token":"HIDDEN","scope":"","expires_in":300,"issued_at":"2022-06-15T16:00:59.464114622Z"}
INFO[0000]
INFO[0000] 0
INFO[0000]
INFO[0000] HEAD /v2/alpine/manifests/3 HTTP/1.1
INFO[0000] Host: registry-1.docker.io
INFO[0000] Accept: application/vnd.docker.distribution.manifest.v2+json, application/vnd.docker.distribution.manifest.list.v2+json, application/vnd.oci.image.manifest.v1+json, application/vnd.oci.image.index.v1+json, */*
INFO[0000] Authorization: Bearer HIDDEN
docker.io/alpine:3: resolving      |--------------------------------------|
elapsed: 0.3 s      total:   0.0 B (0.0 B/s)
INFO[0000] HTTP/1.1 401 Unauthorized
INFO[0000] Content-Length: 149
INFO[0000] Content-Type: application/json
INFO[0000] Date: Wed, 15 Jun 2022 16:00:59 GMT
INFO[0000] Docker-Distribution-Api-Version: registry/2.0
INFO[0000] Strict-Transport-Security: max-age=31536000
INFO[0000] Www-Authenticate: Bearer realm="https://auth.docker.io/token",service="registry.docker.io",scope="repository:alpine:pull",error="insufficient_scope"
INFO[0000]
INFO[0000] trying next host error="pull access denied, repository does not exist or may require authorization: server message: insufficient_scope: authorization failed" host=registry-1.docker.io
ctr: failed to resolve reference "docker.io/alpine:3": pull access denied, repository does not exist or may require authorization: server message: insufficient_scope: authorization failed

**Tags:** dockerhub, authentication, containerd

> **Comments:**
> **username_1**: I am using the similiar command but did not work. `crictl pull --creds "jiangch:$789" registry.cn-shanghai.aliyuncs.com/reddwarf-pro/dolphin-post:a56ae FATA[0000] pulling image: rpc error: code = Unknown desc = failed to pull and unpack image "registry.cn-shanghai.aliyuncs.com/reddwarf-pro/dolphin-post:a56ae": failed to resolve reference "registry.cn-shanghai.aliyuncs.com/reddwarf-pro/dolphin-post:a56ae": pull access denied, repository does not exist or may require authorization: server message: insufficient_scope: authorization failed`  

---

## 2 answers

### Answer by username_0 on 2022-06-15. Score: 3 | Accepted answer

docker.io/library/$IMAGE:$TAG
The problem here is simple the right syntax for ctr isn't docker.io/alpine:latest but docker.io/library/alpine:latest that should now work with --creds "evancarroll:$TOKEN" too.
ctr images pull docker.io/library/alpine:latest

IRC logs
Thanks goes out to larks and ada on IRC #docker for helping out with this,

larsks> EvanCarroll: you probably need to include the tag there (ctr images pull docker.io/library/alpine:latest). The /library is there because that's the actual path to the image repository. There's some magic somewhere that transforms docker.io/alpine into docker.io/library/alpine; I don't know if that's client side or server side; ada will know  much more about that than I do.

And thanks to @ada for showing where this is documented in the code, and clarifying

library/ is the namespace for all the top-level images on dockerhub with docker, that namespace is implied if you leave off the registry & namespace part of the tag : docker pull alpine == ctr images pull docker.io/library/alpine


---

### Answer by username_2 on 2022-10-05. Score: 1

This is actually how I got it working with "ctr containerd.io 1.4.6".

**ctr image pull --user "myusername:mypasswd" myurl.dot.com/docker\_image:1.0.3**

Hope it helps someone.


---

