Docker拉取node镜像GET请求报401，但Firefox/cURL可正常访问

为何GET请求在Firefox/cURL中可成功返回200，但在docker中却返回401 Unauthorized？

下载Docker Desktop并开始教程“如何运行容器？”

步骤1 #

（以管理员身份在CMD中）克隆仓库：

C:\>cd temp\sandbox

C:\temp\sandbox>git clone https://github.com/docker/welcome-to-docker
Cloning into 'welcome-to-docker'...
remote: Enumerating objects: 125, done.
remote: Counting objects: 100% (58/58), done.
remote: Compressing objects: 100% (36/36), done.
remote: Total 125 (delta 33), reused 34 (delta 19), pack-reused 67
Receiving objects: 100% (125/125), 319.54 KiB | 2.88 MiB/s, done.
Resolving deltas: 100% (55/55), done.

C:\temp\sandbox>cd welcome-to-docker
C:\temp\sandbox\welcome-to-docker>

步骤2 #

执行docker build（失败并返回401 Unauthorized）：

C:\temp\sandbox\welcome-to-docker>docker build -t welcome-to-docker .
[+] Building 0.5s (3/3) FINISHED                                         docker:default
 => [internal] load build definition from Dockerfile                               0.0s
 => => transferring dockerfile: 669B                                               0.0s
 => ERROR [internal] load metadata for docker.io/library/node:18-alpine            0.4s
 => [auth] library/node:pull token for registry-1.docker.io                        0.0s
------
 > [internal] load metadata for docker.io/library/node:18-alpine:
------
Dockerfile:2
--------------------
   1 |     # Start your image with a node base image
   2 | >>> FROM node:18-alpine
   3 |
   4 |     # The /app directory should act as the main application directory
--------------------
ERROR: failed to solve: node:18-alpine: failed to resolve source metadata for docker.io/library/node:18-alpine: failed to authorize: failed to fetch oauth token: unexpected status from GET request to https://auth.docker.io/token?scope=repository%3Alibrary%2Fnode%3Apull&service=registry.docker.io: 401 Unauthorized

View build details: docker-desktop://dashboard/build/default/default/wop04cctid0oqc9du02kvac1b

呃，真糟糕。

调试 #

在Firefox中测试报错的GET请求，可正常返回所需令牌：

重试 #

结果相同：

C:\_dev\sandbox\welcome-to-docker>docker build -t welcome-to-docker .
[+] Building 0.6s (3/3) FINISHED                                         docker:default
 => [internal] load build definition from Dockerfile                               0.0s
 => => transferring dockerfile: 669B                                               0.0s
 => ERROR [internal] load metadata for docker.io/library/node:18-alpine            0.5s
 => [auth] library/node:pull token for registry-1.docker.io                        0.0s
------
 > [internal] load metadata for docker.io/library/node:18-alpine:
------
Dockerfile:2
--------------------
   1 |     # Start your image with a node base image
   2 | >>> FROM node:18-alpine
   3 |
   4 |     # The /app directory should act as the main application directory
--------------------
ERROR: failed to solve: node:18-alpine: failed to resolve source metadata for docker.io/library/node:18-alpine: failed to authorize: failed to fetch oauth token: unexpected status from GET request to https://auth.docker.io/token?scope=repository%3Alibrary%2Fnode%3Apull&service=registry.docker.io: 401 Unauthorized

View build details: docker-desktop://dashboard/build/default/default/wzcc4nni8yk8xmgxtqf545jh3

C:\_dev\sandbox\welcome-to-docker>

调试2 #

在CMD中执行cURL请求可正常返回：

C:\_dev\sandbox\welcome-to-docker>curl "https://auth.docker.io/token?scope=repository%3Alibrary%2Fnode%3Apull&service=registry.docker.io"
{"token":"eyJhbG...","expires_in":300,"issued_at":"2024-06-05T19:30:04.377916924Z"}

C:\_dev\sandbox\welcome-to-docker>

问题： #

为何docker向auth.docker.io发送的GET请求无法被识别为授权实体？

以下是几种可能的原因及对应解决方法：

• Docker存储了错误的认证凭据
  检查Docker Hub的认证信息是否过期或错误，执行以下步骤重置：

  1. 打开Docker Desktop，进入Settings > Docker Hub，点击登出后重新登录。
  2. 或在CMD中执行命令：

     docker logout docker.io
     docker login docker.io
     

     输入Docker Hub用户名和密码完成重新认证。

• 代理配置不一致
  Firefox和cURL可能使用系统代理，但Docker代理未同步配置：

  1. 打开Docker Desktop的Settings > Resources > Proxies。
  2. 选择Use system proxy settings，或手动配置与系统一致的代理信息。
  3. 应用设置后重启Docker Desktop。

• Docker Desktop版本兼容性问题
  旧版本Docker Desktop可能存在OAuth令牌获取的bug，更新到最新版本后重试构建操作。

• 安全软件拦截请求
  防火墙或杀毒软件可能过滤Docker的认证请求，临时关闭相关软件或将Docker加入信任列表，再测试构建。

内容的提问来源于stack exchange，提问作者ryvantage