fix: docker auth for docker.io images

docker_auth.go

@@ -10,6 +10,7 @@ import (
 	"fmt"
 	"net/url"
 	"os"
+	"strings"
 	"sync"
 
 	"github.com/cpuguy83/dockercfg"
@@ -42,6 +43,13 @@ func dockerImageAuth(ctx context.Context, image string, configs map[string]regis
 	defaultRegistry := defaultRegistryFn(ctx)
 	reg := core.ExtractRegistry(image, defaultRegistry)
 
+	// Normalize Docker Hub aliases for credential lookup
+	if strings.EqualFold(reg, "docker.io") ||
+		strings.EqualFold(reg, "registry.hub.docker.com") ||
+		strings.EqualFold(reg, "registry-1.docker.io") {
+		reg = defaultRegistry // This is https://index.docker.io/v1/
+	}
+
 	if cfg, ok := getRegistryAuth(reg, configs); ok {
 		return reg, cfg, nil
 	}

docker_auth_test.go

@@ -123,6 +123,20 @@ func TestDockerImageAuth(t *testing.T) {
 		require.Equal(t, base64, cfg.Auth)
 	})
 
+	t.Run("match the default registry authentication by host", func(t *testing.T) {
+		imageReg := "docker.io"
+		imagePath := "/my/image:latest"
+		reg := defaultRegistry(context.Background())
+		base64 := setAuthConfig(t, reg, "gopher", "secret")
+
+		registry, cfg, err := DockerImageAuth(context.Background(), imageReg+imagePath)
+		require.NoError(t, err)
+		require.Equal(t, reg, registry)
+		require.Equal(t, "gopher", cfg.Username)
+		require.Equal(t, "secret", cfg.Password)
+		require.Equal(t, base64, cfg.Auth)
+	})
+
 	t.Run("fail to match registry authentication due to invalid host", func(t *testing.T) {
 		imageReg := "example-auth.com"
 		imagePath := "/my/image:latest"

internal/core/images.go

@@ -100,6 +100,16 @@ func ExtractRegistry(image string, fallback string) string {
 
 	registry := exp[1]
 
+	// docker.io is an implicit reference, return fallback for normalization
+	if strings.EqualFold(registry, "docker.io") {
+		return fallback
+	}
+
+	// registry.hub.docker.com is an explicit registry reference, preserve it
+	if strings.EqualFold(registry, "registry.hub.docker.com") {
+		return "registry.hub.docker.com"
+	}
+
 	if IsURL(registry) {
 		return registry
 	}