Container: not functional when upstream registry is unavailable

[mxey]

The container handler only caches blobs, but even those will not be available if the auth URL for Docker Hub is down.

In handleBlobDownload, getAuthToken is called unconditionally and if it fails, the proxy will respond with an error:

	// Get auth token for upstream
	token, err := h.getAuthToken(r.Context(), name, "pull")
	if err != nil {
		h.proxy.Logger.Error("failed to get auth token", "error", err)
		h.containerError(w, http.StatusUnauthorized, "UNAUTHORIZED", "failed to authenticate")
		return
	}

Only on success will GetOrFetchArtifactFromURLWithHeaders be called, which can respond from cache.

Even besides this, a pull of a specific image digest will still fail, because while the blobs are cached, the manifests are not.

[mxey]

The problem is that the container handler does not use all the request helpers from Proxy because it has to add authentication to it. However, the Fetcher inside Proxy contains code to add authentication to requests.

I think the appropriate refactoring would be to move the auth handling for Docker Hub into that, and then not have to deal with authentication directly anymore.

[mxey]

However, the Fetcher inside Proxy contains code to add authentication to requests.

I have tried to work on this but found out that a lot of the code in Proxy does not actually use Fetcher, and I see no other hook to add authentication to requests. Does this mean that the existing configuration for authentication based on URLs is not functional?

TBH I find it very confusing that there is something called Fetcher that is not used for all fetching.