Repository navigation
Conversation
Contributor
There was a problem hiding this comment.
🟢 Approval recommended
The change is narrowly scoped, aligns with the described regression, and includes a focused unit test validating the new 403 fallback behavior.
Pull request overview
This PR updates the Docker registry pusher logic to treat 403 Forbidden responses from cross-repository blob mount attempts as recoverable (like 401 Unauthorized), so containerd can fall back to a normal direct blob upload instead of failing the push.
Changes:
- Handle
http.StatusForbiddenas a recoverable mount response and retry without the mount optimization. - Improve the debug log to include the actual status code for the mount failure.
- Add a unit test covering the
403 Forbiddenmount failure scenario to ensure fallback behavior.
File summaries
| File | Description |
|---|---|
| core/remotes/docker/pusher.go | Treat 403 on mount as recoverable by clearing the response and falling back to direct upload. |
| core/remotes/docker/pusher_test.go | Add a test case ensuring a 403 during mount triggers the fallback path and the push succeeds. |
Review details
- Files reviewed: 2/2 changed files
- Comments generated: 1
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+221
to
+222
| case http.StatusUnauthorized, http.StatusForbidden: | ||
| log.G(ctx).Debugf("failed to mount from repository %s, not authorized (status %d)", fromRepo, resp.StatusCode) |
Fixes containerd#14086 When pushing an image where containerd attempts a cross-repository blob mount, some registries return 403 Forbidden (instead of 401 Unauthorized) when the authenticated user lacks read access to the mount source repository. Currently, pusher.go only treats 401 Unauthorized as a recoverable condition, causing 403 Forbidden responses to fail the entire push with an unexpected response error rather than falling back to a direct layer upload. Add http.StatusForbidden to the status check so that 403 responses cleanly close the response, reset resp to nil, and fall back to direct blob upload. Signed-off-by: Soumyajit Ghosh <[email protected]> Signed-off-by: SOUMYAJIT GHOSH <[email protected]>
somuai
force-pushed
the
fix-cross-repo-mount-forbidden-fallback
branch
from
September 5, 2026 05:16
6f41e8d to
8206483
Compare
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #14086
Problem
When pushing an image where containerd attempts a cross-repository blob mount, some registries return
403 Forbidden(instead of401 Unauthorized) when the authenticated user does not have read access to the mount source repository.In
core/remotes/docker/pusher.go, containerd only treated401 Unauthorizedas a recoverable condition. Consequently, a403 Forbiddenresponse on the mount attempt was unhandled, causing containerd to skip the fallback and fail the entire push with an unexpected response error (unexpected status from POST request ...: 403 Forbidden).Solution
Include
http.StatusForbiddenalongsidehttp.StatusUnauthorizedin the status switch when handling the cross-repository mount response inpusher.go. This allows containerd to cleanly close the response, resetresp = nil, and fall back to direct blob upload as expected.Testing
Registry returns 403 Forbidden on mounttoTestPusherInvalidAuthorizationOnMountincore/remotes/docker/pusher_test.go.403 Forbiddenerror) and passes cleanly after the fix.core/remotes/dockerpass cleanly.Signed-off-by: Soumyajit Ghosh [email protected]