Description: When pulling docker images from a virtual repository with an anonymous user the docker client throws an error message saying that the manifest for the image is not found instead of an unauthorized message. However, If we try pulling the same image via local repository then a correct error message (unauthorized) will be displayed.
Steps to reproduce:
1. Enable Anonymous access for the Artifactory and the Anonymous user does not have any permission to the docker repository.
2. Create a docker local repository.
3. Create a docker virtual repository and add the above local repository in it.
4. Push a Docker image to the docker local repository via a docker virtual repository with the privileged user.
5. Perform docker logout.
6. Try to pull the image from the Anonymous user via the local repository and could see the below correct error message.
➜ ~ docker pull Artifactory.info:12345/docker-local-test/hello-world Using default tag: latest Error response from daemon: unauthorized: The client does not have permission for manifest
Request log
20200709072502|41|REQUEST|XXXXXXX|anonymous|GET|/api/docker/docker-local-test/v2/hello-world/manifests/latest|HTTP/1.1|403|0
7. Try to pull the image from the Anonymous user via virtual repository and could see the below Incorrect error message.
➜ ~ docker pull Artifactory.info:12345/docker-virtual/hello-world Using default tag: latest Error response from daemon: manifest for Artifactory.info:12345/docker-virtual/hello-world:latest not found: manifest unknown: The named manifest is not known to the registry.
Request log :
20200709072429|67|REQUEST|XXXXXXXXX|anonymous|GET|/api/docker/docker-virtual/v2/hello-world/manifests/latest|HTTP/1.1|404|0
Expected result: Even when we try to pull the image via a docker virtual repository using an anonymous user we should get an unauthorized error message.
Impact: Currently the error message from the virtual repo is confusing. If the end-users do not know what is local/virtual repo in the Artifactory and It will cost them a lot of time to troubleshoot the issue. Artifactory should tell the docker client that it needs authentication in that case.
