mirror of
https://github.com/project-zot/zot.git
synced 2026-06-17 12:58:02 +08:00
Andrei Aaron
7ceb01dcff
* fix(auth): add workaround for Docker client auth with mixed anonymous policies Docker client fails to authenticate to protected repositories when basic auth (htpasswd/LDAP) is used with mixed access policies (some repos anonymous, some requiring auth). This happens because Docker determines whether to send credentials based on the /v2/ response - if it returns 200, Docker assumes no auth is needed anywhere. Add `forceDockerClientAuth` config option that, when enabled, forces 401 on /v2/ for Docker clients, triggering Docker's authentication flow. This workaround only affects Docker clients (detected via User-Agent). Podman and other OCI-compliant clients are unaffected. Refs: https://github.com/opencontainers/wg-auth/blob/main/docs/implementations/moby.md Signed-off-by: Andrei Aaron <andreifdaaron@gmail.com> * feat: remove ForceDockerClientAuth flag and use only authz policies to determine the docker specific behavior Signed-off-by: Andrei Aaron <andreifdaaron@gmail.com> --------- Signed-off-by: Andrei Aaron <andreifdaaron@gmail.com>