foreign layers not pulled properly

[ixdy]

The windows images seem to use foreign layers hosted by Microsoft. For example, the windows 10.0.17134.228 image for docker's hello-world image has this manifest:

{
        "schemaVersion": 2,
        "mediaType": "application/vnd.docker.distribution.manifest.v2+json",
        "config": {
                "mediaType": "application/vnd.docker.container.image.v1+json",
                "size": 1882,
                "digest": "sha256:abe16c070a65267297b0550b0e0b3644e6c859199cb93f5badf899885bbed1fc"
        },
        "layers": [
                {
                        "mediaType": "application/vnd.docker.image.rootfs.foreign.diff.tar.gzip",
                        "size": 92818888,
                        "digest": "sha256:e46172273a4e4384e1eec7fb01091c828a256ea0f87b30f61381fba9bc511371",
                        "urls": [
                                "https://go.microsoft.com/fwlink/?linkid=873594"
                        ]
                },
                {
                        "mediaType": "application/vnd.docker.image.rootfs.foreign.diff.tar.gzip",
                        "size": 48632111,
                        "digest": "sha256:1f7d468f830cb0ed4beb8edc9438f18096e8c682e56a35242f60e6c61b718b30",
                        "urls": [
                                "https://go.microsoft.com/fwlink/?linkid=2009809"
                        ]
                },
                {
                        "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
                        "size": 1664,
                        "digest": "sha256:35655e48c5c5c1c21f19073b2594d74b5023ae2cd84bf7f7f45acb886e1b5e34"
                },
                {
                        "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
                        "size": 945,
                        "digest": "sha256:8159aad5f944a2967427ce18283248707fb15071b202e00de4ffd105e9ed6ace"
                }
        ]
}

Trying to download this image will fail, since it's trying to download the foreign image from the docker registry, rather than following the provided URLs:

F1120 15:03:28.953516  191191 fast_puller_.py:117] Error pulling and saving image index.docker.io/library/hello-world@sha256:670f0dc439e4669bc602cc571af9f72271ea3b39002416fe2398feb36a7ac20d: response: {'status': '404', 'content-length': '157', 'strict-transport-security': 'max-age=31536000', 'docker-distribution-api-version': 'registry/2.0', 'date': 'Tue, 20 Nov 2018 23:03:28 GMT', 'content-type': 'application/json; charset=utf-8'}
blob unknown to registry: sha256:e46172273a4e4384e1eec7fb01091c828a256ea0f87b30f61381fba9bc511371

[ixdy]

@dekkagaijin did you ever start working on this, as suggested in google/go-containerregistry#207 (comment)?

[dekkagaijin]

I did, but for now it's only supported for remote -> remote registry transfers, which allows for gcloud container images add-tag to work with windows containers. More work will be required for pulls to work (but shouldn't be difficult). I've been on another team for the last 6 months, so maybe @KaylaNguyen or @deft-code can assist? I'd be happy to point to the relevant change internally :)