Referring to the code at

From my reading of the registry API spec (https://docs.docker.com/registry/spec/api/#content-digests) it appears that the Docker-Content-Digest header is optional.

To provide verification of http content, any response may include a Docker-Content-Digest header.

Therefore it feels like this should not be required from the registry.

In particular the registry.access.redhat.com registry does not specify this header. The following code demonstrates the problem:

package main
  
import (
  "context"
  "fmt"
  "net/http"

  "github.com/containerd/containerd/remotes/docker"
)

func main() {
  resolver := docker.NewResolver(docker.ResolverOptions{
    Client: http.DefaultClient,
  })

  name, desc, err := resolver.Resolve(context.TODO(), "registry.access.redhat.com/rhel7/rhel:7.3")
  // name, desc, err := resolver.Resolve(context.TODO(), "quay.io/quay/ubuntu:latest")
  if err != nil {
    fmt.Println(err)
    panic(err)
  }
  fmt.Println(name)
  fmt.Println(desc)
}

I'm happy to make a PR for this if there is agreement that this behavior should be changed.