Description

Sandbox controller doesn't pass credentials down to PullImage (it passes nil):

If hosts config_path is set, the path taken is:

As credentials is nil, proper auth is never attached.

When a container (not a sanbox) is created, another path to PullImage sets the credentials properly:

(if hosts are not configured, another path is taken which re-reads auth from ImageService config, so the issue doesn't appear)

Steps to reproduce the issue

Configure the sandbox image to be hosted in a repository behind auth:

  [plugins]
    [plugins."io.containerd.cri.v1.images".pinned_images]
      sandbox = "my-secret-registry/pause:3.10"  

     [plugins.'io.containerd.cri.v1.images'.registry.configs.'my-secret-registry'.auth]
          username = 'root'
          password = 'secret'

Make sure hosts_directory is set (otherwise the code path taken is different, and the issue is not reproducible):

    [plugins.'io.containerd.cri.v1.images'.registry]
      config_path = '/etc/cri/conf.d/hosts'

Describe the results you received and expected

Expected success, instead pod sandbox is not created with 401 Unauthorized error, as credentials are not passed.

What version of containerd are you using?

v2.0.0-rc.6 + main

Any other relevant information

No response

Show configuration if it is related to CRI plugin.

No response