containerd/containerd · error

unsupported Content-Encoding algorithm:

Error message

unsupported Content-Encoding algorithm: 

What it means

When a registry response carries a Content-Encoding header, the fetcher transparently decompresses gzip/deflate or accepts identity/empty. Any other algorithm string is rejected with this error because containerd has no decoder for it.

Source

Thrown at core/remotes/docker/fetcher.go:662

			r, err := zstd.NewReader(body.ReadCloser,
				zstd.WithDecoderLowmem(false),
			)
			if err != nil {
				return nil, 0, err
			}
			body.ReadCloser = r.IOReadCloser()
		case "gzip":
			r, err := gzip.NewReader(body.ReadCloser)
			if err != nil {
				return nil, 0, err
			}
			body.ReadCloser = r
		case "deflate":
			body.ReadCloser = flate.NewReader(body.ReadCloser)
		case "identity", "":
			// no content-encoding applied, use raw body
		default:
			return nil, 0, errors.New("unsupported Content-Encoding algorithm: " + algorithm)
		}
	}

	return body, remaining, nil
}

type fnOnClose struct {
	BeforeClose func()
	io.ReadCloser
}

// Close calls the BeforeClose function before closing the underlying
// ReadCloser.
func (f *fnOnClose) Close() error {
	f.BeforeClose()
	return f.ReadCloser.Close()
}

View on GitHub (pinned to 4246446a2b)

Solutions

1. Fix the proxy/CDN in front of the registry to not set unsupported Content-Encoding (disable brotli for the registry route)
2. Update containerd — newer versions handle more encodings
3. Bypass the proxy (NO_PROXY / direct registry access) to confirm the proxy is the cause
4. If you control the client code, strip/normalize the Content-Encoding header before it reaches open

Example fix

// nginx proxy in front of registry
// before
gzip_proxied any; brotli on;
// after: never encode registry responses
proxy_set_header Accept-Encoding "";
gzip off;

enc := resp.Header.Get("Content-Encoding")
switch enc {
case "", "identity", "gzip", "deflate":
    // ok
default:
    return fmt.Errorf("registry/proxy sends unsupported encoding %q", enc)
}

rc, _, err := fetcher.open(ctx, desc)
if err != nil && strings.Contains(err.Error(), "unsupported Content-Encoding") {
    return fetchWithoutProxy(ctx, desc) // fallback path
}

When it happens

Trigger: Calling fetcher.open (via Fetch) against a response whose Content-Encoding is an unsupported value (e.g. 'br'/brotli, 'zstd', or a garbage value) injected by a proxy or non-compliant registry.

Common situations: Corporate proxies or CDNs (Cloudflare) adding Content-Encoding: br to registry responses; misconfigured reverse proxies setting Content-Encoding on already-decoded bodies; custom registries setting exotic encodings.

Related errors

• no realm specified for token auth challenge
• failed to discard to offset: %w
• unable to fetch descriptor (%s) which reports content size o
• authorization server did not include a token in the response
• cannot truncate remote upload

AI-assisted analysis of containerd/containerd@4246446a2b (2026-09-02). Data as JSON: /api/errors/b754ac1c36f7561a. Report an issue: GitHub.