Moving from rules_docker, oci_pull unathorized on hub.docker.com

[tradergt]

So I am trying to move from rules_docker but getting an error on oci_pull.

Rules_docker:

container_pull(
    name = "debian_slim_python3",
    digest = "sha256:417042aec1ad34cc84567fc0ce3dfb20edbd252e338fc18728a80d394f7b1f17",
    registry = "index.docker.io",
    repository = "python",
    tag = "3.11.4-slim-bullseye",
)

And when I convert that to oci_pull:

oci_pull(
    name = "debian_slim_python3_oci",
    # digest = "sha256:417042aec1ad34cc84567fc0ce3dfb20edbd252e338fc18728a80d394f7b1f17",
    image = "index.docker.io/python",
    tag = "3.11.4-slim-bullseye",
)

Bazel logs show I am getting an unauthorized

WARNING: fetching from https://index.docker.io/v2/python/manifests/3.11.4-slim-bullseye without an integrity hash. The result will not be cached.
WARNING: Could not fetch the manifest. Either there was an authentication issue or trying to pull an image with OCI image media types.
Falling back to using `curl`. See https://github.com/bazelbuild/bazel/issues/17829 for the context.
WARNING: fetching from https://index.docker.io/v2/python/manifests/3.11.4-slim-bullseye without an integrity hash. The result will not be cached.
INFO: Repository debian_slim_python3_oci instantiated at:
  /home/tradergt/modules/dba-utilities/WORKSPACE:167:9: in <toplevel>
  /home/tradergt/.cache/bazel/_bazel_tradergt/5ec41db2c4e272bc949a06a673e6483b/external/rules_oci/oci/pull.bzl:142:14: in oci_pull
Repository rule oci_alias defined at:
  /home/tradergt/.cache/bazel/_bazel_tradergt/5ec41db2c4e272bc949a06a673e6483b/external/rules_oci/oci/private/pull.bzl:523:28: in <toplevel>
WARNING: Download from https://index.docker.io/v2/python/manifests/3.11.4-slim-bullseye failed: class com.google.devtools.build.lib.bazel.repository.downloader.UnrecoverableHttpException GET returned 401 Unauthorized
ERROR: An error occurred during the fetch of repository 'debian_slim_python3_oci':

I am not expert but that does not look like the right link to me. BTW, I should not need to authorize to hub.docker.com as the containers I use are 100% public.

This works fine with rules_docker and I even confirmed by removing all my local cache and it re-downloaded it just fine.

If we need more details/logs to help debug this, let me know...

[tradergt]

Forgot to post, I have set up rules_oci as such:

http_archive(
    name = "rules_oci",
    sha256 = "176e601d21d1151efd88b6b027a24e782493c5d623d8c6211c7767f306d655c8",
    strip_prefix = "rules_oci-1.2.0",
    url = "https://github.com/bazel-contrib/rules_oci/releases/download/v1.2.0/rules_oci-v1.2.0.tar.gz",
)

load("@rules_oci//oci:dependencies.bzl", "rules_oci_dependencies")

rules_oci_dependencies()

load("@rules_oci//oci:repositories.bzl", "LATEST_CRANE_VERSION", "LATEST_ZOT_VERSION", "oci_register_toolchains")

oci_register_toolchains(
    name = "oci",
    crane_version = LATEST_CRANE_VERSION,
    # Uncommenting the zot toolchain will cause it to be used instead of crane for some tasks.
    # Note that it does not support docker-format images.
    # zot_version = LATEST_ZOT_VERSION,
)
load("@rules_oci//oci:pull.bzl", "oci_pull")

[farcop]

oci_pull(
    name = "debian_slim_python3_oci",
    image = "docker.io/library/python",
    tag = "3.11.4-slim-bullseye",
    platforms = [
        "linux/amd64",
        "linux/arm64/v8",
    ],
)

Works

[thesayyn]

You need library prefix for official images on the docker hub. that's what is missing for you.

oci_pull(
    image = "index.docker.io/library/python",
)

[tradergt]

Thanks! yeah library did it...