podman outputs misleading error in some cases where docker API v1 & v2 is enabled. Is it possible to tell podman to not ping v1?

[carlosrodfern]

When there is an error pinging the Docker API v2, podman, through the image library, attempts to ping v1, and if the Docker Registry has that v1 API enabled, then the output error is "can't talk to a v1 container registry", however, the original error for ping v2 is missing.

The problem appears to come down to this code: https://github.com/containers/image/blob/31d4ad14fe4da8ef3969ff67297831ab291c76f1/docker/docker_client.go#L903

If the ping v2 fails, the ping(..) method returns error, so then ping v1 is attempted. If that one succeeds, the actual error from ping v2 is not displayed. When there are connectivity issues, for example, it is possible for a docker registry that has both v1 and v2 enabled to fail with v2 and then succeed with v1. It would be preferable that the library errors with the actual ping v2 error plus a note that v1 was detected and is not supported.

The code does have a property that checks if the DockerDisableV1Ping is true, and the comment explains this same scenario saying "if true, a V1 ping attempt isn't done to give users a better error". However, I can't find anywhere where podman loads that flag from any config.

Is there a way to tell podman to not even try v1?

[Luap99]

@mtrmac PTAL

[mtrmac]

No, DockerDisableV1Ping is not exposed, and I don’t think it makes much sense to make it a user-visible option.

We should change the error message, or, possibly, remove the /v1 part entirely — I’ve been working on c/image since it was created, and even back then I can’t recall encountering a /v1/ registry.

[carlosrodfern]

@mtrmac,

docker.io/v1 was indeed deprecated two years ago. However, image still uses /v1/search to search things in docker.io. For what I can see in the code, it is because of UX, because docker.io/v2/_catalog was disabled back then? (it requires authentication now). Everything else appears to use /v2.

Would it make sense to remove only the call to ping v1 when detecting properties? All it does is to see if /v1 is enabled to then say it is not supported, but with the assumption that the reason /v2/_ping failed is because it is not supported by the registry, which the reality can actually be a little bit different. I can work on a PR to remove the ping to v1 if that's the best course of action.

[carlosrodfern]

I posted this PR to resolve this issue: containers/image#2588