Can't configure Podman to perform unqualified image search in Artifactory Docker repository

[Joshua-Schroijen]

Hello everyone,

I am in the process of setting up a local Docker repository on Artifactory to be used with Podman. My goal is for this Docker repository to be the only one my users have access to. My users will be using Podman on Windows 11 as their container runtime. After logging in using podman login artifactory.acme.com successfully, I can pull images from this repository using their fully qualified names perfectly. But for my users' convenience, I would like to set up Podman for unqualified search through my own repository instead of Docker Hub and Quay. This is where I run into trouble: I can't seem to figure out how to configure this properly given Artifactory's special structure.

Right now, in my Podman machine (podman-machine-default running in Windows Subsystem for Linux 2) I put the following into /etc/registries.conf:

unqualified-search-registries = ["artifactory.acme.com"]
short-name-mode = "permissive"

The configuration of my actual registry is in /etc/containers/registries.conf.d/999-podman-desktop-registries-from-host.conf containing:

[[registry]]
prefix = "artifactory.acme.com"
location = "artifactory.acme.com/artifactory/common-docker"

[[registry]]
location = "quay.io"
blocked = true

[[registry]]
location = "docker.io"
blocked = true

My Artifactory repository is a Docker V2 repository called common-docker. I verified that it should be accessible because I can browse to artifactory.acme.com/artifactory/common-docker just fine and because, as I said earlier, fully qualified image pulls work well.

I uploaded the latest busybox image into my Artifactory repository common-docker. When I run podman pull busybox I get the following error:

PS C:\Users\joshua> podman pull busybox
Resolving "busybox" using unqualified-search registries (/etc/containers/registries.conf)
Trying to pull artifactory.acme.com/busybox:latest...
Error: 1 error occurred while pulling:
 * unable to copy from source docker://artifactory.acme.com/busybox:latest: initializing source docker://artifactory.acme.com/busybox:latest: reading manifest latest in artifactory.acme.com/artifactory/common-docker/busybox: unknown: Not Found

I suspect the root issue here is that Docker clients like Podman can't handle registries only being available behind a context path (i.e. artifactory.acme.com/artifactory/common-docker instead of just artifactory.acme.com). I therefore suspect the solution might be to set up a reverse proxy that e.g. rewrites something like container-registry.artifactory.acme.com to artifactory.acme.com/artifactory/common-docker. But the Artifactory host server is outside of my control and setting up reverse proxies in my environment faces many practical constraints. Therefore, I wonder:

• first of all, if I'm not trying to set this up wrong or making a silly mistake somewhere
• second of all, if there is a different workaround than setting up a reverse proxy

Any help or input would be very appreciated! Thank you in advance!