{"record":{"id":"b754ac1c36f7561a","repo":"containerd/containerd","slug":"unsupported-content-encoding-algorithm","errorCode":null,"errorMessage":"unsupported Content-Encoding algorithm: ","messagePattern":"unsupported Content-Encoding algorithm: ","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"core/remotes/docker/fetcher.go","lineNumber":662,"sourceCode":"\t\t\tr, err := zstd.NewReader(body.ReadCloser,\n\t\t\t\tzstd.WithDecoderLowmem(false),\n\t\t\t)\n\t\t\tif err != nil {\n\t\t\t\treturn nil, 0, err\n\t\t\t}\n\t\t\tbody.ReadCloser = r.IOReadCloser()\n\t\tcase \"gzip\":\n\t\t\tr, err := gzip.NewReader(body.ReadCloser)\n\t\t\tif err != nil {\n\t\t\t\treturn nil, 0, err\n\t\t\t}\n\t\t\tbody.ReadCloser = r\n\t\tcase \"deflate\":\n\t\t\tbody.ReadCloser = flate.NewReader(body.ReadCloser)\n\t\tcase \"identity\", \"\":\n\t\t\t// no content-encoding applied, use raw body\n\t\tdefault:\n\t\t\treturn nil, 0, errors.New(\"unsupported Content-Encoding algorithm: \" + algorithm)\n\t\t}\n\t}\n\n\treturn body, remaining, nil\n}\n\ntype fnOnClose struct {\n\tBeforeClose func()\n\tio.ReadCloser\n}\n\n// Close calls the BeforeClose function before closing the underlying\n// ReadCloser.\nfunc (f *fnOnClose) Close() error {\n\tf.BeforeClose()\n\treturn f.ReadCloser.Close()\n}\n","sourceCodeStart":644,"sourceCodeEnd":680,"githubUrl":"https://github.com/containerd/containerd/blob/4246446a2bf7d03837b0244118d858799393bd80/core/remotes/docker/fetcher.go#L644-L680","documentation":"When a registry response carries a Content-Encoding header, the fetcher transparently decompresses gzip/deflate or accepts identity/empty. Any other algorithm string is rejected with this error because containerd has no decoder for it.","triggerScenarios":"Calling fetcher.open (via Fetch) against a response whose Content-Encoding is an unsupported value (e.g. 'br'/brotli, 'zstd', or a garbage value) injected by a proxy or non-compliant registry.","commonSituations":"Corporate proxies or CDNs (Cloudflare) adding Content-Encoding: br to registry responses; misconfigured reverse proxies setting Content-Encoding on already-decoded bodies; custom registries setting exotic encodings.","solutions":["Fix the proxy/CDN in front of the registry to not set unsupported Content-Encoding (disable brotli for the registry route)","Update containerd — newer versions handle more encodings","Bypass the proxy (NO_PROXY / direct registry access) to confirm the proxy is the cause","If you control the client code, strip/normalize the Content-Encoding header before it reaches open"],"exampleFix":"// nginx proxy in front of registry\n// before\ngzip_proxied any; brotli on;\n// after: never encode registry responses\nproxy_set_header Accept-Encoding \"\";\ngzip off;","handlingStrategy":"fallback","validationCode":"enc := resp.Header.Get(\"Content-Encoding\")\nswitch enc {\ncase \"\", \"identity\", \"gzip\", \"deflate\":\n    // ok\ndefault:\n    return fmt.Errorf(\"registry/proxy sends unsupported encoding %q\", enc)\n}","typeGuard":null,"tryCatchPattern":"rc, _, err := fetcher.open(ctx, desc)\nif err != nil && strings.Contains(err.Error(), \"unsupported Content-Encoding\") {\n    return fetchWithoutProxy(ctx, desc) // fallback path\n}","preventionTips":["Disable brotli/unsupported encodings on proxies fronting registries","Send explicit Accept-Encoding headers from clients","Test pulls through the full proxy chain during setup"],"tags":["containerd","http","content-encoding","registry","proxy"],"backgroundTag":"unsupported-content-encoding","analyzedSha":"4246446a2bf7d03837b0244118d858799393bd80","analyzedAt":"2026-09-02T00:14:43.053Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-09T06:17:21.866Z"}