fix

components/image-builder-bob/pkg/proxy/auth.go

@@ -23,6 +23,18 @@ func isECRRegistry(domain string) bool {
 	return ecrRegistryRegexp.MatchString(domain)
 }
 
+// isDockerHubRegistry returns true if the registry domain is an docker hub
+func isDockerHubRegistry(domain string) bool {
+	switch domain {
+	case "registry-1.docker.io":
+		fallthrough
+	case "docker.io":
+		return true
+	default:
+		return false
+	}
+}
+
 // authConfig configures authentication for a single host
 type authConfig struct {
 	Username string `json:"username"`
@@ -40,15 +52,36 @@ func (a MapAuthorizer) Authorize(host string) (user, pass string, err error) {
 		}).Info("authorizing registry access")
 	}()
 
-	res, ok := a[host]
-	if !ok {
-		if !isECRRegistry(host) {
-			return
+	explicitHostMatcher := func() (authConfig, bool) {
+		res, ok := a[host]
+		return res, ok
+	}
+	ecrHostMatcher := func() (authConfig, bool) {
+		if isECRRegistry(host) {
+			res, ok := a[DummyECRRegistryDomain]
+			return res, ok
 		}
-		res, ok = a[DummyECRRegistryDomain]
-		if !ok {
-			return
+		return authConfig{}, false
+	}
+	dockerHubHostMatcher := func() (authConfig, bool) {
+		if isDockerHubRegistry(host) {
+			res, ok := a["docker.io"]
+			return res, ok
 		}
+		return authConfig{}, false
+	}
+
+	matchers := []func() (authConfig, bool){explicitHostMatcher, ecrHostMatcher, dockerHubHostMatcher}
+	res, ok := authConfig{}, false
+	for _, matcher := range matchers {
+		res, ok = matcher()
+		if ok {
+			break
+		}
+	}
+
+	if !ok {
+		return
 	}
 
 	user, pass = res.Username, res.Password

components/image-builder-bob/pkg/proxy/proxy.go

@@ -31,9 +31,10 @@ func NewProxy(host *url.URL, aliases map[string]Repo, mirrorAuth func() docker.A
 		aliases[k] = v
 	}
 	return &Proxy{
-		Host:    *host,
-		Aliases: aliases,
-		proxies: make(map[string]*httputil.ReverseProxy),
+		Host:       *host,
+		Aliases:    aliases,
+		proxies:    make(map[string]*httputil.ReverseProxy),
+		mirrorAuth: mirrorAuth,
 	}, nil
 }
 
@@ -130,13 +131,12 @@ func (proxy *Proxy) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 
 	// get mirror host
 	if host := r.URL.Query().Get("ns"); host != "" && (r.Method == http.MethodGet || r.Method == http.MethodHead) {
-		if host == "docker.io" {
-			host = "registry-1.docker.io"
-		}
+		host, _ = docker.DefaultHost(host)
+
 		r.URL.Host = host
 		r.Host = host
 
-		auth := proxy.mirrorAuth
+		auth := proxy.mirrorAuth()
 		r = r.WithContext(context.WithValue(ctx, authKey, auth))
 
 		r.RequestURI = ""