oci_pull gets 401 Unauthorized on curl.

[tonyliao-mineral]

I want to build an Apache Beam SDK image like this:

oci_image(
    name = "move_data_worker_image",
    base = "@beam_python",
    entrypoint = [
        "/opt/apache/beam/boot",
    ],
    tars = [":move_data_layer"],
)

where the base image comes from my WORKSPACE:

# https://hub.docker.com/r/apache/beam_python3.10_sdk/tags
oci_pull(
    name = "beam_python",
    # 2.51.0
    digest = "sha256:af507ee3b2fc7e0ad154c9c0caafdc3c3191886cce36943f40c8f91e776f117e",
    image = "index.docker.io/library/apache/beam_python3.10_sdk",
    # registry = "registry.hub.docker.com",
    # repository = "apache/beam_python3.10_sdk",
)

I was able to do docker pull apache/beam_python3.10_sdk:2.51.0 on the command line. But during Bazel build I get a really weird error:

@beam_python//:beam_python depends on @beam_python_single//:beam_python_single in
repository @beam_python_single which failed to fetch. no such package '@beam_python_single//':
curl https://index.docker.io/v2/library/apache/beam_python3.10_sdk/manifests/sha256:af507ee3b2
fc7e0ad154c9c0caafdc3c3191886cce36943f40c8f91e776f117e returned non-success status code 401
On some research I found this un-answered stack post: Bazel's container_pull failing to pull aws-cli image which has very similar errors. There are also #284 that seems to have a similar but different issue. So it seems like it's not Beam related. I'm wondering if anyone has seen this before. Thanks!

[tonyliao-mineral]

Update: falling back to rules_docker's container_pull with the exact same input works fine:

# https://hub.docker.com/r/apache/beam_python3.10_sdk/tags
container_pull(
    name = "beam_python",
    # 2.51.0
    digest = "sha256:af507ee3b2fc7e0ad154c9c0caafdc3c3191886cce36943f40c8f91e776f117e",
    registry = "registry.hub.docker.com",
    repository = "apache/beam_python3.10_sdk",
)

[alexeagle]

I think the translation is incorrect.

    registry = "registry.hub.docker.com",
    repository = "apache/beam_python3.10_sdk",

-> index.docker.io/apache/beam_python3.10_sdk

You have an extra /library/ segment in your non-working example, which is only used for containers that don't have a namespace IIUC

[gfrankliu]

Based on #301 , the extra library is required. Am I missing something?