{"record":{"id":"5c0120433c20fe69","repo":"containerd/containerd","slug":"failed-to-fetch-anonymous-token-w","errorCode":null,"errorMessage":"failed to fetch anonymous token: %w","messagePattern":"failed to fetch anonymous token: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"core/remotes/docker/authorizer.go","lineNumber":345,"sourceCode":"\t\t\t\t\t\treturn \"\", \"\", err\n\t\t\t\t\t}\n\t\t\t\t\texpirationTime = getExpirationTime(resp.ExpiresInSeconds)\n\t\t\t\t\treturn resp.Token, resp.RefreshToken, nil\n\t\t\t\t}\n\t\t\t\tlog.G(ctx).WithFields(log.Fields{\n\t\t\t\t\t\"status\": errStatus.Status,\n\t\t\t\t\t\"body\":   string(errStatus.Body),\n\t\t\t\t}).Debugf(\"token request failed\")\n\t\t\t}\n\t\t\treturn \"\", \"\", err\n\t\t}\n\t\texpirationTime = getExpirationTime(resp.ExpiresInSeconds)\n\t\treturn resp.AccessToken, resp.RefreshToken, nil\n\t}\n\t// do request anonymously\n\tresp, err := auth.FetchToken(ctx, ah.client, ah.header, to)\n\tif err != nil {\n\t\treturn \"\", \"\", fmt.Errorf(\"failed to fetch anonymous token: %w\", err)\n\t}\n\texpirationTime = getExpirationTime(resp.ExpiresInSeconds)\n\treturn resp.Token, resp.RefreshToken, nil\n}\n\nfunc getExpirationTime(expiresInSeconds int) *time.Time {\n\tif expiresInSeconds <= 0 {\n\t\treturn nil\n\t}\n\texpirationTime := time.Now().Add(time.Duration(expiresInSeconds) * time.Second)\n\treturn &expirationTime\n}\n\nfunc invalidAuthorization(ctx context.Context, c auth.Challenge, responses []*http.Response) (retry bool, _ error) {\n\terrStr := c.Parameters[\"error\"]\n\tif errStr == \"\" {\n\t\treturn retry, nil\n\t}","sourceCodeStart":327,"sourceCodeEnd":363,"githubUrl":"https://github.com/containerd/containerd/blob/4246446a2bf7d03837b0244118d858799393bd80/core/remotes/docker/authorizer.go#L327-L363","documentation":"When no credentials are available, the docker authorizer requests an anonymous bearer token with auth.FetchToken (GET flow); any failure is wrapped as 'failed to fetch anonymous token'. It means the public token endpoint refused or failed the unauthenticated token request. The underlying error is preserved via %w.","triggerScenarios":"doBearerAuth with empty secret calls auth.FetchToken(ctx, ah.client, ah.header, to) and the GET to the realm token endpoint fails: non-2xx response, network error, TLS error, or invalid JSON token response.","commonSituations":"Pulling a private image anonymously (registry returns 401/denied for the scope); token service temporarily down; DNS or proxy misconfiguration in clusters; corporate MITM proxy breaking TLS to the realm; scope requiring auth though image metadata looked public.","solutions":["Check the wrapped cause: if 401/403, the image/scope is not publicly pullable — supply credentials","Verify connectivity from the node to the token realm URL (curl the realm endpoint)","If behind a proxy, configure the client/proxy env so TLS to the realm works","Retry on transient 5xx; if persistent, check registry service health"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"resp, err := http.Get(realm + \"?service=\" + service + \"&scope=\" + scope)\nif err != nil || resp.StatusCode != http.StatusOK {\n    return fmt.Errorf(\"anonymous token for scope %s unavailable (status %v) — supply credentials\", scope, status)\n}","typeGuard":null,"tryCatchPattern":"if err != nil {\n    if strings.Contains(err.Error(), \"401\") || strings.Contains(err.Error(), \"403\") {\n        // fall back to authenticated pull with credentials\n    }\n    return fmt.Errorf(\"anonymous token fetch failed: %w\", err)\n}","preventionTips":["Don't assume images are publicly pullable; configure creds for private repos","Verify realm DNS/TLS from the runtime environment","Handle transient 5xx with retry/backoff","Check proxy env (HTTP_PROXY/HTTPS_PROXY) correctness on nodes"],"tags":["auth","registry","anonymous","network"],"backgroundTag":"token-fetch-failed","analyzedSha":"4246446a2bf7d03837b0244118d858799393bd80","analyzedAt":"2026-09-02T00:14:43.053Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-09T06:17:21.866Z"}