registry errors lack detail

[errordeveloper]

When tagging an image with multiple registries using buildx, push errors carry too little context, here is an example:

 => ERROR exporting to image                                                                        2.3s
 => => exporting layers                                                                             0.0s
 => => exporting manifest sha256:ffa0b92bcd6b8f5c40ffedb3c61d92ae96852c8a772ffe71821f2a2b9bf430f1   0.0s
 => => exporting config sha256:034c62d91e4d09126acfd0855dfef66f6e5511f7eec9080e0b2201a5a989abca     0.0s
 => => pushing layers                                                                               2.3s
------
 > exporting to image:
------
error: failed to solve: rpc error: code = Unknown desc = unexpected status: 401 UNAUTHORIZED

The only way to tell which of the registries replied with this error, is to try pushing to one registry at a time, which is not easy in CI, especially if errors occur sporadically.

At very least it would be good to see the URL, but seeing request payload (perhaps in debug mode) would be nice too.

This turns out to be a buildkit issue and not a buuildx one, as all of the error message are passed along using very generic machinery, so the context will have to come from buildkit. It doesn't help that there is grcp client as well, which may need a small change to accommodate for fixing this.

I have started by improving containerd (containerd/containerd#5164), but I am little lost in buildkit code, so will need some concrete pointers.

[errordeveloper]

Also, even when only one registry is being used, it's still hard to tell what could be wrong. I also wonder what it might look like for multiple images in the context of buildx bake.

[thaJeztah]

Also related;

• DockerFetcher swallows non-JSON errors returned by registries  containerd/containerd#4672
• buildkit not propagating unauthorized error message #2938