{"record":{"id":"371110389976c9da","repo":"containerd/containerd","slug":"failed-to-get-fetcher-for-q-w-371110","errorCode":null,"errorMessage":"failed to get fetcher for %q: %w","messagePattern":"failed to get fetcher for %q: %w","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"core/transfer/local/pull.go","lineNumber":108,"sourceCode":"\t\t\treturn fmt.Errorf(\"image verifier %s blocked pull of %v with digest %v for reason: %v\", vfName, name, desc.Digest.String(), jdg.Reason)\n\t\t}\n\t\tlogger.Debug(\"Image verifier allowed pull\")\n\t}\n\n\t// TODO: Handle already exists\n\tif tops.Progress != nil {\n\t\ttops.Progress(transfer.Progress{\n\t\t\tEvent: fmt.Sprintf(\"Pulling from %s\", ir),\n\t\t})\n\t\ttops.Progress(transfer.Progress{\n\t\t\tEvent: \"fetching image content\",\n\t\t\tName:  name,\n\t\t\tDesc:  &desc,\n\t\t})\n\t}\n\tfetcher, err := ir.Fetcher(ctx, name)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to get fetcher for %q: %w\", name, err)\n\t}\n\n\tvar (\n\t\thandler images.Handler\n\n\t\tbaseHandlers []images.Handler\n\n\t\tunpacker *unpack.Unpacker\n\n\t\t// has a config media type bug (distribution#1622)\n\t\thasMediaTypeBug1622 bool\n\n\t\tstore           = ts.content\n\t\tprogressTracker *ProgressTracker\n\t)\n\n\tctx, cancel := context.WithCancel(ctx)\n\tif tops.Progress != nil {","sourceCodeStart":90,"sourceCodeEnd":126,"githubUrl":"https://github.com/containerd/containerd/blob/4246446a2bf7d03837b0244118d858799393bd80/core/transfer/local/pull.go#L90-L126","documentation":"Wraps the error from the resolver's Fetcher method, which constructs the object used to download blobs for the resolved image. Resolution succeeded but building the fetcher (e.g. establishing a registry session/authorizer) failed.","triggerScenarios":"ir.Fetcher(ctx, name) fails after a successful Resolve: usually authentication/authorization setup errors for the registry, invalid host configuration in the resolver, or an unsupported scheme.","commonSituations":"Registry credentials expired between resolve and fetch; hosts.toml misconfiguration (bad mirror URL/scheme); resolver configured for a host the client cannot construct a fetcher for.","solutions":["Check the wrapped error and fix registry host/credential configuration (hosts.toml, auth)","Re-run with registry debug logging to see which host request fails","Retry in case of a transient token/session failure","Validate the reference and resolver configuration match the intended registry"],"exampleFix":"// before\n[host.\"https://mirror.local\"]\n  capabilities = [\"pull\"]   # fetcher setup fails due to bad TLS\n// after\n[host.\"https://mirror.local\"]\n  capabilities = [\"pull\"]\n  ca = \"/etc/containerd/certs.d/mirror.local/ca.crt\"  # provide correct CA","handlingStrategy":"retry","validationCode":"// validate hosts.toml and auth for the registry before transfer\nu, _ := url.Parse(\"https://\" + registryHost)\nc, err := (&http.Client{}).Get(u.String() + \"/v2/\")\nif err != nil || c.StatusCode >= 500 { return errors.New(\"registry unreachable\") }","typeGuard":null,"tryCatchPattern":"err := ts.Transfer(ctx, puller, dest, cfg)\nif err != nil && strings.Contains(err.Error(), \"failed to get fetcher\") {\n    // refresh credentials/session then retry with backoff\n}","preventionTips":["Refresh registry tokens before long transfers","Validate hosts.toml (CA certs, mirrors, capabilities) after changes","Keep resolver configuration symmetric between resolve and fetch"],"tags":["containerd","registry","fetcher","pull"],"backgroundTag":"fetcher-creation-failed","analyzedSha":"4246446a2bf7d03837b0244118d858799393bd80","analyzedAt":"2026-09-02T00:14:43.053Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-09T06:17:21.866Z"}