Description

The registry token sent to the registry is not automatically refreshed even if the credentials are provided.

Taking docker hub as an example, the access token / registry token for anonymous pull is around 300s (i.e. 5 mins). If a reference is resolved and then resolve it again after 5 mins, the docker resolver will report an error. Docker resolver should retry by itself and should not rely on the call to retry.

Steps to reproduce the issue

No response

Describe the results you received and expected

Running the following code:

package main

import (
	"context"
	"fmt"
	"net/http"
	"time"

	"github.com/containerd/containerd/remotes/docker"
)

func main() {
	ref := "docker.io/library/hello-world:latest"
	ctx := context.Background()
	resolver := docker.NewResolver(docker.ResolverOptions{})

	_, _, err := resolver.Resolve(ctx, ref)
	fmt.Println(err)

	time.Sleep(6 * time.Minute)

	_, _, err = resolver.Resolve(ctx, ref)
	fmt.Println(err)
}

Actual output:

<nil>
time="2021-12-14T22:56:15+08:00" level=info msg="trying next host" error="pull access denied, repository does not exist or may require authorization: server message: invalid_token: authorization failed" host=registry-1.docker.io
pull access denied, repository does not exist or may require authorization: server message: invalid_token: authorization failed

Expected output:

<nil>
<nil>

What version of containerd are you using?

v1.6.0-beta.3

Any other relevant information

No response

Show configuration if it is related to CRI plugin.

No response