trivy registry login fails for docker.io with "unknown resource type" error

[rafaeltc]

Description

Two issues with docker.io authentication:

1. trivy registry login docker.io fails with "unknown resource type" error
2. Even when credentials are stored correctly in ~/.docker/config.json (via other tools), private image scanning fails with unauthorized errors

Desired Behavior

1. trivy registry login should succeed for docker.io
2. When scanning images in private docker.io registries, Trivy should authenticate using stored credentials in ~/.docker/config.json

Actual Behavior

1. Login fails:

echo $REGISTRY_PASSWORD | trivy registry login --username $REGISTRY_USER --password-stdin docker.io -d
ERROR - GET https://auth.docker.io/token?scope=registry%3Acatalog%3A%2A&service=registry.docker.io: unexpected status code 400 Bad Request: {"details":"unknown resource type"}

2. Subsequent scans fail with UNAUTHORIZED despite valid credentials in ~/.docker/config.json
3. Only works with TRIVY_USERNAME/TRIVY_PASSWORD environment variables

Reproduction Steps

1. Attempt login `echo $REGISTRY_PASSWORD | trivy registry login --username $REGISTRY_USER --password-stdin docker.io`
2. Verify credentials in `~/.docker/config.json` (can be populated via skopeo/docker login)
3. Scan private image `trivy image <private-dockerhub-image>`
4. Observe UNAUTHORIZED error
5. Set environment variables:

export TRIVY_USERNAME=<dockerio_username>
export TRIVY_PASSWORD=<dockerio_password>

6. Retry scan - works with env vars but not with config.json

Target

Container Image

Scanner

Vulnerability

Output Format

Table

Mode

Standalone

Debug Output

$ echo $REGISTRY_PASSWORD | trivy registry login --username $REGISTRY_USER --password-stdin docker.io -d
DEBUG	Default config file "file_path=trivy.yaml" not found, using built in values
DEBUG	Cache dir	dir="/Users/xxx/Library/Caches/trivy"
DEBUG	Cache dir	dir="/Users/xxx/Library/Caches/trivy"
FATAL	Fatal error
  - failed to authenticate:
    github.com/aquasecurity/trivy/pkg/commands/auth.Login
        github.com/aquasecurity/trivy/pkg/commands/auth/run.go:39
  - GET https://auth.docker.io/token?scope=registry%3Acatalog%3A%2A&service=registry.docker.io: unexpected status code 400 Bad Request: {"details":"unknown resource type"}

$ trivy image xxx/batatafrita:zbatata -d
DEBUG	Default config file "file_path=trivy.yaml" not found, using built in values
DEBUG	Cache dir	dir="/Users/xxx/Library/Caches/trivy"
DEBUG	Cache dir	dir="/Users/xxx/Library/Caches/trivy"
DEBUG	Parsed severities	severities=[UNKNOWN LOW MEDIUM HIGH CRITICAL]
DEBUG	Ignore statuses	statuses=[]
DEBUG	DB update was skipped because the local DB is the latest
DEBUG	DB info	schema=2 updated_at=2025-02-11T06:16:18.593167792Z next_update=2025-02-12T06:16:18.593167431Z downloaded_at=2025-02-11T11:49:46.685809Z
DEBUG	[pkg] Package types	types=[os library]
DEBUG	[pkg] Package relationships	relationships=[unknown root workspace direct indirect]
INFO	[vuln] Vulnerability scanning is enabled
INFO	[secret] Secret scanning is enabled
INFO	[secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
INFO	[secret] Please see also https://aquasecurity.github.io/trivy/v0.59/docs/scanner/secret#recommendation for faster secret detection
DEBUG	Initializing scan cache...	type="fs"
FATAL	Fatal error
  - image scan error:
    github.com/aquasecurity/trivy/pkg/commands/artifact.Run
        github.com/aquasecurity/trivy/pkg/commands/artifact/run.go:402
  - scan error:
    github.com/aquasecurity/trivy/pkg/commands/artifact.(*runner).scanArtifact
        github.com/aquasecurity/trivy/pkg/commands/artifact/run.go:261
  - unable to initialize a scanner:
    github.com/aquasecurity/trivy/pkg/commands/artifact.(*runner).scan
        github.com/aquasecurity/trivy/pkg/commands/artifact/run.go:623
  - unable to initialize an image scanner:
    github.com/aquasecurity/trivy/pkg/commands/artifact.imageStandaloneScanner
        github.com/aquasecurity/trivy/pkg/commands/artifact/scanner.go:16
  - unable to find the specified image "xxx/batatafrita:zbatata" in ["docker" "containerd" "podman" "remote"]:
    github.com/aquasecurity/trivy/pkg/fanal/image.NewContainerImage
        github.com/aquasecurity/trivy/pkg/fanal/image/image.go:58
  - 4 errors occurred:
	* docker error: unable to inspect the image (xxx/batatafrita:zbatata): Error response from daemon: No such image: xxx/batatafrita:zbatata
	* containerd error: containerd socket not found: /run/containerd/containerd.sock
	* podman error: unable to initialize Podman client: no podman socket found: stat podman/podman.sock: no such file or directory
	* remote error: GET https://index.docker.io/v2/xxx/batatafrita/manifests/zbatata: UNAUTHORIZED: authentication required; [map[Action:pull Class: Name:xxx/batatafrita Type:repository]]

Operating System

macOS 15.2

Version

Version: 0.59.1

Checklist

• Run trivy clean --all
• Read the troubleshooting

[DmitriyLewen]

Hello @rafaeltc
Thanks for your report!

Created #8386 for this bug.

Regards, Dmitriy