buildkit not propagating unauthorized error message

[nicks]

Filing this on behalf of a user.

They store their images inside a VPN. When they pull, the error message tells them to connect to the VPN:

docker pull XXXXX/XXXXX/baseplate-py:2-py3.9-bullseye-dev
Error response from daemon: unauthorized: Please connect to the VPN.

But when they build, the error message about the VPN does not appear:

 docker build .
[+] Building 0.2s (5/5) FINISHED
 => [internal] load build definition from Dockerfile                                                                                                                   0.0s
 => => transferring dockerfile: 1.89kB                                                                                                                                 0.0s
 => [internal] load .dockerignore                                                                                                                                      0.0s
 => => transferring context: 364B                                                                                                                                      0.0s
 => [internal] load metadata for XXXXX/XXXXX/baseplate-py:2-py3.9-buster-dev                                                 0.0s
 => CANCELED [internal] load metadata for XXXXX/XXXXX/node:14-dev                                                            0.1s
 => ERROR [internal] load metadata for XXXXX/XXXXX/baseplate-py:2-py3.9-buster                                               0.1s
------
 > [internal] load metadata for XXXXX/XXXXX/baseplate-py:2-py3.9-buster:
------
failed to solve with frontend dockerfile.v0: failed to create LLB definition: unexpected status code [manifests 2-py3.9-buster]: 401 Unauthorized

Expected Behavior

I would expect the buildkit error message to also echo the "Please connect to the VPN." message.

Any ideas where this might be getting dropped? I tried to read through the auth error handling but got a little lost. This also might be a problem with an upstream component.

[thaJeztah]

I think this may be related to containerd/containerd#4672 (and further discussion on containerd/containerd#4674)

[nicks]

yes, that definitely looks plausible!