remotes: surface OCI error body in registry 4xx responses by cshung · Pull Request #13547 · containerd/containerd

cshung · 2026-06-08T18:14:17Z

Problem

When a registry rejects a HEAD request with 403 Forbidden (e.g., CMK-disabled ACR, IP firewall, RBAC), the error body containing the diagnostic message is lost — HEAD responses carry no body per HTTP spec. This affects kubelet image pulls and push existence checks, where the user only sees "403 Forbidden" with no explanation.

Solution

When a HEAD request returns 403, issue a follow-up GET to retrieve the registry's OCI error body. The existing unexpectedResponseErr machinery already parses the body into structured errors — it just needs the body to be present.

Scoped to 403 only because:

403 is rare (CMK, IP firewall, RBAC) and its body is highly diagnostic
Other status codes either already use GET or have bodies that add no value (e.g., 404 from tag probing)

Changes

File	What
`core/remotes/docker/resolver.go`	HEAD 403 → GET fallback during resolve
`core/remotes/docker/pusher.go`	HEAD 403 → GET fallback during push existence check
`core/remotes/docker/resolver_test.go`	4 tests (fallback, no double-GET, 404 unaffected, network error)
`core/remotes/docker/pusher_test.go`	2 tests (push 403 fallback, proxy namespace)

End-to-End Validation

Tested with a mock registry returning OCI error bodies and with Azure Container Registry (CMK-disabled).

Kubelet pull (HEAD 403, CMK-disabled ACR):

Before:

Failed to pull image: ...403 Forbidden

After:

Failed to pull image: ...403 Forbidden
denied: Access to Key Encryption Key is forbidden

ctr push --local (BuildKit code path):

Before:

ctr: failed commit on ref "...": unexpected status from PUT ... 403 Forbidden

After:

ctr: failed commit on ref "...": unexpected status from PUT ... 403 Forbidden
denied: Access to Key Encryption Key is forbidden

Fixes #8969

Copilot

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

This PR prepares the containerd v2.1.6 release by bumping the project version/toolchain, updating vendored dependencies, and landing a set of runtime/CRI/transfer/remotes fixes plus EROFS enhancements.

Changes:

Bump containerd to v2.1.6 and update Go toolchain + numerous dependencies (including vendored modules and CI images).
Improve runtime/CRI reliability (stable handler ordering, sandbox exit monitoring/backoff behavior, pidfd handling, directory permissions hardening).
Enhance EROFS and remotes behavior (optional immutable layers, mkfs UUID for reproducibility, better 403 diagnostics via GET fallback).

Reviewed changes

Copilot reviewed 100 out of 300 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
version/version.go	Bumps containerd version string to 2.1.6.
vendor/modules.txt	Updates vendored module versions and Go version metadata.
script/setup/runhcs-version	Bumps runhcs version used by setup scripts.
script/setup/runc-version	Bumps runc version used by setup scripts.
script/setup/prepare_env_windows.ps1	Updates Go version installed in Windows environment prep.
script/setup/install-runhcs-shim	Adjusts git fetch/checkout flow for runhcs shim source selection.
script/setup/install-dev-tools	Updates dev tool install versions (md2man).
releases/v2.1.6.toml	Adds release metadata for v2.1.6.
releases/v2.1.5.toml	Adds release metadata for v2.1.5.
releases/v2.1.4.toml	Adds release metadata for v2.1.4.
releases/v2.1.3.toml	Adds release metadata for v2.1.3.
releases/v2.1.2.toml	Adds release metadata for v2.1.2.
releases/v2.1.1.toml	Adds release metadata for v2.1.1.
plugins/transfer/plugin.go	Tweaks differ selection preference + adds duplication suppressor.
plugins/snapshots/erofs/plugin/plugin_linux.go	Adds `set_immutable` config flag for EROFS snapshotter.
plugins/snapshots/erofs/erofs_linux.go	Implements `WithImmutable`, error wrapping, and conditional immutable flag.
plugins/services/transfer/service.go	Adds debug logging when transfer is unimplemented for src/dst types.
plugins/sandbox/controller.go	Tightens sandbox dir permissions and enforces chmod on upgrade.
plugins/diff/erofs/differ_linux.go	Adjusts media type parsing and passes UUID into mkfs conversion.
plugins/cri/runtime/plugin.go	Ensures CRI state dir permissions are tightened on upgrade.
pkg/sys/unshare_linux.go	Adds pidfd support check and ensures pidfd is closed.
pkg/deprecation/deprecation.go	Updates deprecation removal versions to v2.3 for several settings.
pkg/archive/tar_test.go	Adds breakout regression test and temp-name setup.
pkg/archive/tar.go	Removes RootPath memoization and refactors tar extraction helpers.
internal/erofsutils/mount_linux.go	Adds optional UUID support to mkfs.erofs invocation.
internal/cri/util/sanitize_test.go	Adds tests for URL sanitization helper.
internal/cri/util/sanitize.go	Adds URL query redaction helper for errors containing *url.Error.
internal/cri/server/status_test.go	Adds test for stable runtime handler ordering (uses fake client).
internal/cri/server/status.go	Sorts runtime handlers for stable ordering in Status response.
internal/cri/server/restart.go	Handles missing sandbox metadata by deleting leaked entries on restart.
internal/cri/server/podsandbox/events.go	Lowers noisy TaskExit log to Debug.
internal/cri/server/podsandbox/controller.go	Adjusts event monitor usage; emits structured TaskExit events for sandbox monitor.
internal/cri/server/events/events_test.go	Adds test for starting event monitor without subscriptions.
internal/cri/server/events/events.go	Removes start-time panic and improves shutdown error handling.
internal/cri/server/events.go	Improves exit event logging context/wording.
internal/cri/server/container_attach.go	Updates Attach call to accept context.
internal/cri/opts/container.go	Removes idmap mount options for volume copy-up in CRI path.
internal/cri/nri/nri_api_linux.go	Handles nil NRI adjustment result safely.
internal/cri/io/container_io.go	Adds context-aware Attach to prevent writeGroup buildup on client cancel.
internal/cri/instrument/instrumented_service.go	Sanitizes errors before logging for image APIs to avoid leaking secrets.
internal/cri/config/config_unix.go	Documents SystemdCgroup default in config template.
internal/cri/config/config.go	Updates deprecation comment removal versions for registry config fields.
integration/sandbox_run_linux_test.go	Adds integration test for podsandbox exit-event backoff behavior.
integration/restart_linux_test.go	Adds stress restart test for 100 pods + cleanup assertions.
integration/release_upgrade_linux_test.go	Refactors upgrade tests to support multi-step verification + shim version mismatch case.
integration/pod_userns_linux_test.go	Adds userns volume copy-up test targeting ownership invariants.
integration/issue10467_linux_test.go	Adapts to upgrade test API returning a slice of verify funcs.
integration/image_load_test.go	Skips image-load test on Windows Server 2025 hosts.
integration/container_io_leak_linux_test.go	Adds integration regression test for start-failure IO leak.
integration/client/import_test.go	Fetches with explicit platform matcher in import/export tests.
integration/client/helpers_windows.go	Adds WS2025 detection helper via hcsshim osversion.
integration/client/helpers_unix.go	Adds stub host-skip helper on non-Windows.
go.sum	Updates checksums for bumped and newly added modules.
go.mod	Bumps Go version and updates dependencies.
docs/tracing.md	Updates client tracing setup to use otelgrpc stats handler.
docs/snapshotters/erofs.md	Adds `toml` fence; expands EROFS integrity docs (immutable + fs-verity).
docs/cri/config.md	Documents `cgroup_writable` option.
core/unpack/unpacker.go	Improves extraction error message with more context.
core/transfer/proxy/transfer.go	Converts gRPC errors to native errors in proxy transferrer.
core/transfer/local/pull_test.go	Updates getSupportedPlatform signature to accept context.
core/transfer/local/pull.go	Improves unpack platform matching + logs unsupported configs.
core/transfer/local/progress.go	Avoids blocking sends after tracker completion.
core/transfer/local/import.go	Fixes manifest annotation mutation and uses ctx-aware platform matcher.
core/runtime/v2/task_manager.go	Clarifies directory permission intent for root/state.
core/runtime/v2/shim_load.go	Adds shim client API downgrade retry when PID is unimplemented.
core/runtime/v2/shim.go	Adjusts log level, bootstrap file perms, otelgrpc handler usage, and sandbox API gating.
core/runtime/v2/binary.go	Improves dead-shim cleanup logging with shim ID and structured fields.
core/remotes/errors/errors.go	Registers ErrUnexpectedStatus with typeurl; adds JSON tags for serialization.
core/remotes/docker/resolver_test.go	Adds coverage for 403 HEAD->GET fallback behavior and edge cases.
core/remotes/docker/resolver.go	Implements 403 GET fallback to capture registry error bodies; refactors error handling.
core/remotes/docker/pusher_test.go	Adds test for pusher 403 HEAD->GET fallback error body inclusion.
core/remotes/docker/pusher.go	Implements 403 GET fallback for existence checks; uses unified unexpected response error.
core/remotes/docker/fetcher_test.go	Expands fetcher tests: range unsupported, missing content-length, limiter deadlock regression.
core/remotes/docker/fetcher.go	Refines parallel download gating and ensures limiter release on error/close paths.
core/remotes/docker/errcode.go	Adds unified `unexpectedResponseErr` which joins typed registry errors onto status errors.
core/mount/temp.go	Adds helper to remove uidmap/gidmap mount options.
core/mount/mount_linux_test.go	Adds tests for idmapped overlay cleanup and path handling improvements.
core/mount/mount_linux.go	Refactors idmapped overlay setup to mount common dir once; improves mount error context.
core/content/testsuite/testsuite.go	Deduplicates writer cleanup logic and improves failure handling.
core/content/helpers.go	Improves short-read error message with expected/actual bytes.
contrib/fuzz/oss_fuzz_build.sh	Bumps Go version used by OSS-Fuzz build.
contrib/Dockerfile.test	Bumps Go version used in test container image.
cmd/ctr/commands/shim/shim.go	Adds `ctr shim shutdown` command with API version selection.
cmd/ctr/commands/client.go	Adds socket path existence check before connecting.
cmd/containerd/server/server.go	Tightens root/temp dir permissions and applies chmod on upgrades.
cmd/containerd-shim-runc-v2/process/init.go	Ensures IO is closed on Create failure; increases drain timeout and logs errors.
cmd/containerd-shim-runc-v2/process/exec.go	Increases drain timeout and logs IO drain errors.
client/task.go	Determines runtime via `defaultRuntime()` rather than fixed client field.
client/client.go	Makes runtime resolution lazy and namespace-label aware with synchronization.
Vagrantfile	Bumps Fedora base box and Go version used in vagrant provisioning.
RELEASES.md	Updates deprecation table removal versions (v2.3).
BUILDING.md	Updates Go support statement to “two most recent major versions”.
.mailmap	Adds additional Austin Vazquez email mapping.
.github/workflows/windows-periodic.yml	Drops LTSC2019 periodic runs.
.github/workflows/windows-hyperv-periodic.yml	Drops LTSC2019 hyperv periodic runs.
.github/workflows/release/Dockerfile	Sets default GO_VERSION for release builds.
.github/workflows/release.yml	Moves to ubuntu-latest; removes explicit GO_VERSION build arg usage.
.github/workflows/fuzz.yml	Updates oss-fuzz CI action pins for ubuntu-24-04 support.
.github/workflows/ci.yml	Updates runner matrices, Go versions, quoting, and removes Windows 2019 upgrade steps.
.github/workflows/api-release.yml	Bumps GO_VERSION for API release workflow.
.github/actions/install-go/action.yml	Bumps default Go version installed by action.
.devcontainer/devcontainer.json	Bumps Go version used by devcontainer feature.

Comments suppressed due to low confidence (4)

internal/cri/server/status_test.go:1

for range numHandlers does not compile in Go because range requires an iterable. Replace with an index loop (e.g., for i := 0; i < numHandlers; i++ { ... }) or range over a slice with length numHandlers.
internal/cri/util/sanitize.go:1
Returning rawURL on parse failure can still leak sensitive query parameters (for example, malformed escaping in a URL containing ?sig=...). Prefer a conservative fallback that redacts or strips the query portion even when parsing fails (e.g., split on ? and drop/replace the query string) to avoid leaking credentials into logs.
pkg/archive/tar.go:1
This change removes the previous RootPath memoization and now calls fs.RootPath repeatedly in the main tar loop. If fs.RootPath performs filesystem lookups, this can regress extraction performance on large layers. Consider reintroducing a safe per-apply cache (bounded map or LRU) for parent path resolutions, or otherwise avoid resolving the same ppath repeatedly within a single Apply call.
internal/cri/server/restart.go:1
The comment references "Before 1162" but the linked PR is #11612; "1162" looks like a typo and the sentence is a bit unclear. Consider correcting the PR number and rewording for clarity (e.g., "Before #11612, ...").

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

cshung · 2026-06-08T18:22:50Z

Note: The Copilot review above is stale — it reviewed an incorrect diff (300 files) caused by a branch issue that has since been force-pushed to fix. This PR contains only a 4-file, single-commit change. Please disregard that review.

Copilot

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 3 comments.

Copilot

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 5 comments.

When a registry returns 403 Forbidden on a HEAD request (e.g., manifest resolve or push existence check), the diagnostic error body is lost because HEAD responses carry no body per HTTP spec. This leaves users with an opaque "403 Forbidden" message and no actionable guidance. Add a follow-up GET on HEAD 403 to retrieve the registry's OCI error body. The existing unexpectedResponseErr machinery already parses the body into structured errors — it just needs the body to be present. The fallback lives in a shared withGETErrorBody helper used by both the pusher and resolver: it only enriches when the GET also returns 403, and preserves the original HEAD request's method and status while borrowing just the body, so the resulting error's status and body stay consistent. Scoped to 403 only because it is rare (CMK key disabled, IP firewall, RBAC misconfiguration) and its body is highly diagnostic, while other status codes either already use GET or have bodies that add no value. Fixes containerd#8969 Signed-off-by: Andrew Au <[email protected]>

Copilot

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

cshung · 2026-07-08T18:15:03Z

/cherry-pick release/1.7
/cherry-pick release/2.0
/cherry-pick release/2.2
/cherry-pick release/2.3

k8s-infra-cherrypick-robot · 2026-07-08T18:15:13Z

@cshung: only containerd org members may request cherry picks. If you are already part of the org, make sure to change your membership to public. Otherwise you can still do the cherry-pick manually.

Details

In response to this:

/cherry-pick release/1.7
/cherry-pick release/2.0
/cherry-pick release/2.2
/cherry-pick release/2.3

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

fuweid · 2026-07-08T18:24:49Z

/cherry-pick release/1.7
/cherry-pick release/2.0
/cherry-pick release/2.2
/cherry-pick release/2.3

k8s-infra-cherrypick-robot · 2026-07-08T18:25:27Z

@fuweid: #13547 failed to apply on top of branch "release/1.7":

Applying: remotes: surface OCI error body on HEAD 403 via GET fallback
Using index info to reconstruct a base tree...
A	core/remotes/docker/pusher.go
A	core/remotes/docker/pusher_test.go
A	core/remotes/docker/resolver.go
A	core/remotes/docker/resolver_test.go
Falling back to patching base and 3-way merge...
Auto-merging remotes/docker/pusher.go
CONFLICT (content): Merge conflict in remotes/docker/pusher.go
Auto-merging remotes/docker/pusher_test.go
Auto-merging remotes/docker/resolver.go
CONFLICT (content): Merge conflict in remotes/docker/resolver.go
Auto-merging remotes/docker/resolver_test.go
CONFLICT (content): Merge conflict in remotes/docker/resolver_test.go
error: Failed to merge in the changes.
hint: Use 'git am --show-current-patch=diff' to see the failed patch
hint: When you have resolved this problem, run "git am --continue".
hint: If you prefer to skip this patch, run "git am --skip" instead.
hint: To restore the original branch and stop patching, run "git am --abort".
hint: Disable this message with "git config set advice.mergeConflict false"
Patch failed at 0001 remotes: surface OCI error body on HEAD 403 via GET fallback

Details

In response to this:

/cherry-pick release/1.7
/cherry-pick release/2.0
/cherry-pick release/2.2
/cherry-pick release/2.3

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

k8s-infra-cherrypick-robot · 2026-07-08T18:26:02Z

@fuweid: #13547 failed to apply on top of branch "release/2.0":

Applying: remotes: surface OCI error body on HEAD 403 via GET fallback
Using index info to reconstruct a base tree...
M	core/remotes/docker/pusher.go
M	core/remotes/docker/pusher_test.go
M	core/remotes/docker/resolver.go
M	core/remotes/docker/resolver_test.go
Falling back to patching base and 3-way merge...
Auto-merging core/remotes/docker/pusher.go
CONFLICT (content): Merge conflict in core/remotes/docker/pusher.go
Auto-merging core/remotes/docker/pusher_test.go
Auto-merging core/remotes/docker/resolver.go
CONFLICT (content): Merge conflict in core/remotes/docker/resolver.go
Auto-merging core/remotes/docker/resolver_test.go
CONFLICT (content): Merge conflict in core/remotes/docker/resolver_test.go
error: Failed to merge in the changes.
hint: Use 'git am --show-current-patch=diff' to see the failed patch
hint: When you have resolved this problem, run "git am --continue".
hint: If you prefer to skip this patch, run "git am --skip" instead.
hint: To restore the original branch and stop patching, run "git am --abort".
hint: Disable this message with "git config set advice.mergeConflict false"
Patch failed at 0001 remotes: surface OCI error body on HEAD 403 via GET fallback

Details

In response to this:

/cherry-pick release/1.7
/cherry-pick release/2.0
/cherry-pick release/2.2
/cherry-pick release/2.3

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

k8s-infra-cherrypick-robot · 2026-07-08T18:26:36Z

@fuweid: #13547 failed to apply on top of branch "release/2.2":

Applying: remotes: surface OCI error body on HEAD 403 via GET fallback
Using index info to reconstruct a base tree...
M	core/remotes/docker/pusher.go
M	core/remotes/docker/pusher_test.go
M	core/remotes/docker/resolver.go
M	core/remotes/docker/resolver_test.go
Falling back to patching base and 3-way merge...
Auto-merging core/remotes/docker/pusher.go
Auto-merging core/remotes/docker/pusher_test.go
Auto-merging core/remotes/docker/resolver.go
Auto-merging core/remotes/docker/resolver_test.go
CONFLICT (content): Merge conflict in core/remotes/docker/resolver_test.go
error: Failed to merge in the changes.
hint: Use 'git am --show-current-patch=diff' to see the failed patch
hint: When you have resolved this problem, run "git am --continue".
hint: If you prefer to skip this patch, run "git am --skip" instead.
hint: To restore the original branch and stop patching, run "git am --abort".
hint: Disable this message with "git config set advice.mergeConflict false"
Patch failed at 0001 remotes: surface OCI error body on HEAD 403 via GET fallback

Details

In response to this:

/cherry-pick release/1.7
/cherry-pick release/2.0
/cherry-pick release/2.2
/cherry-pick release/2.3

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

k8s-infra-cherrypick-robot · 2026-07-08T18:27:13Z

@fuweid: new pull request created: #13738

Details

In response to this:

/cherry-pick release/1.7
/cherry-pick release/2.0
/cherry-pick release/2.2
/cherry-pick release/2.3

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

When a registry returns 403 Forbidden on a HEAD request (e.g., manifest resolve or push existence check), the diagnostic error body is lost because HEAD responses carry no body per HTTP spec. This leaves users with an opaque "403 Forbidden" message and no actionable guidance. Add a follow-up GET on HEAD 403 to retrieve the registry's OCI error body. The fallback lives in a shared withGETErrorBody helper used by both the pusher and resolver: it only enriches when the GET also returns 403, and preserves the original HEAD request's method and status while borrowing just the body, so the resulting error's status and body stay consistent. Scoped to 403 only because it is rare (CMK key disabled, IP firewall, RBAC misconfiguration) and its body is highly diagnostic, while other status codes either already use GET or have bodies that add no value. Backport of #13547 to release/2.0, hand-adapted for this branch: it predates the shared unexpectedResponseErr helper, so withGETErrorBody decodes the registry error body inline (mirroring that helper's decode-and-join) and uses the older doWithRetries signature. Fixes #8969 Signed-off-by: Andrew Au <[email protected]> (cherry picked from commit 5c66703)

Copilot AI review requested due to automatic review settings June 8, 2026 18:14

github-project-automation Bot added this to Pull Request Review Jun 8, 2026

github-project-automation Bot moved this to Needs Triage in Pull Request Review Jun 8, 2026

k8s-ci-robot added do-not-merge/contains-merge-commits needs-rebase size/XXL labels Jun 8, 2026

Copilot AI reviewed Jun 8, 2026

View reviewed changes

Comment thread cmd/containerd/server/server.go

Comment thread core/mount/mount_linux.go

Comment thread core/mount/temp.go

Comment thread cmd/ctr/commands/client.go

Comment thread core/remotes/docker/fetcher_test.go

cshung closed this Jun 8, 2026

cshung force-pushed the resolve-403-error-body branch from 27e941c to af60379 Compare June 8, 2026 18:18

github-project-automation Bot moved this from Needs Triage to Done in Pull Request Review Jun 8, 2026

k8s-ci-robot added size/XS and removed do-not-merge/contains-merge-commits size/XXL labels Jun 8, 2026

cshung reopened this Jun 8, 2026

github-project-automation Bot moved this from Done to Needs Triage in Pull Request Review Jun 8, 2026

k8s-ci-robot added size/L and removed needs-rebase size/XS labels Jun 8, 2026

cshung marked this pull request as draft June 8, 2026 18:33

k8s-ci-robot added the do-not-merge/work-in-progress label Jun 8, 2026

cshung force-pushed the resolve-403-error-body branch from 3d18178 to 5ad9ce8 Compare June 8, 2026 19:25

Copilot AI review requested due to automatic review settings June 8, 2026 19:25

Copilot AI reviewed Jun 8, 2026

View reviewed changes

Comment thread core/remotes/docker/resolver.go Outdated

Comment thread core/remotes/docker/resolver.go

Comment thread core/remotes/errors/errors.go Outdated

cshung changed the title ~~remotes/docker: retrieve error body on 403 Forbidden from HEAD requests~~ remotes: surface OCI error body in registry 4xx responses Jun 8, 2026

cshung force-pushed the resolve-403-error-body branch from 5ad9ce8 to bbfa1af Compare June 9, 2026 16:40

cshung marked this pull request as ready for review June 9, 2026 17:23

Copilot AI review requested due to automatic review settings June 9, 2026 17:23

k8s-ci-robot removed the do-not-merge/work-in-progress label Jun 9, 2026

Copilot AI reviewed Jun 9, 2026

View reviewed changes

Comment thread core/remotes/docker/errcode.go

Comment thread core/remotes/docker/errcode.go Outdated

Comment thread core/remotes/docker/errcode.go Outdated

Comment thread core/remotes/docker/resolver.go

Comment thread core/remotes/docker/pusher.go Outdated

Copilot AI review requested due to automatic review settings July 7, 2026 21:20

cshung force-pushed the resolve-403-error-body branch from 4c31b00 to 5c66703 Compare July 7, 2026 21:20

Copilot started reviewing on behalf of cshung July 7, 2026 21:20 View session

Copilot AI reviewed Jul 7, 2026

View reviewed changes

Comment thread core/remotes/docker/resolver.go

fuweid approved these changes Jul 8, 2026

View reviewed changes

fuweid added this pull request to the merge queue Jul 8, 2026

fuweid removed this pull request from the merge queue due to a manual request Jul 8, 2026

fuweid added this pull request to the merge queue Jul 8, 2026

Merged via the queue into containerd:main with commit 52f8124 Jul 8, 2026
122 of 129 checks passed

github-project-automation Bot moved this from Review In Progress to Done in Pull Request Review Jul 8, 2026

cshung deleted the resolve-403-error-body branch July 8, 2026 17:21

fuweid added cherry-pick/1.7.x Change to be cherry picked to release/1.7 branch cherry-pick/2.0.x Change to be cherry picked to release/2.0 branch cherry-pick/2.2.x Change to be cherry picked to release/2.2 branch cherry-pick/2.3.x Change to be cherry picked to release/2.3 labels Jul 8, 2026

k8s-infra-cherrypick-robot mentioned this pull request Jul 8, 2026

[release/2.3] remotes: surface OCI error body in registry 4xx responses #13738

Merged

Uh oh!

Conversation

cshung commented Jun 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Problem

Solution

Changes

End-to-End Validation

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

cshung commented Jun 8, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

cshung commented Jul 8, 2026

Uh oh!

k8s-infra-cherrypick-robot commented Jul 8, 2026

Uh oh!

fuweid commented Jul 8, 2026

Uh oh!

k8s-infra-cherrypick-robot commented Jul 8, 2026

Uh oh!

k8s-infra-cherrypick-robot commented Jul 8, 2026

Uh oh!

k8s-infra-cherrypick-robot commented Jul 8, 2026

Uh oh!

k8s-infra-cherrypick-robot commented Jul 8, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

cshung commented Jun 8, 2026 •

edited

Loading