feat: enable authenticated pulls

go.mod

@@ -35,7 +35,7 @@ require (
 	github.com/containerd/stargz-snapshotter/estargz v0.16.3 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/dimchansky/utfbom v1.1.1 // indirect
-	github.com/distribution/reference v0.6.0 // indirect
+	github.com/distribution/reference v0.6.0
 	github.com/docker/cli v28.3.1+incompatible
 	github.com/docker/distribution v2.8.3+incompatible // indirect
 	github.com/docker/docker v28.3.1+incompatible

pkg/runtimes/docker/container.go

@@ -27,10 +27,15 @@ import (
 	"fmt"
 	"io"
 
+	"github.com/distribution/reference"
+	dockerconfig "github.com/docker/cli/cli/config"
+	dockerconfigfile "github.com/docker/cli/cli/config/configfile"
+	dockerconfigtypes "github.com/docker/cli/cli/config/types"
 	"github.com/docker/docker/api/types"
 	"github.com/docker/docker/api/types/container"
 	"github.com/docker/docker/api/types/filters"
 	dockerimage "github.com/docker/docker/api/types/image"
+	registrytypes "github.com/docker/docker/api/types/registry"
 	"github.com/docker/docker/client"
 	l "github.com/k3d-io/k3d/v5/pkg/logger"
 	k3d "github.com/k3d-io/k3d/v5/pkg/types"
@@ -104,9 +109,41 @@ func removeContainer(ctx context.Context, ID string) error {
 	return nil
 }
 
+// resolveAuth gets registry authentication configuration for an image
+func resolveAuth(image string) (authConfig registrytypes.AuthConfig, err error) {
+	var ref reference.Named
+	var config *dockerconfigfile.ConfigFile
+	var dockerAuthConfig dockerconfigtypes.AuthConfig
+	if ref, err = reference.ParseNormalizedNamed(image); err != nil {
+		return
+	}
+	authKey := reference.Domain(ref)
+	if authKey == "docker.io" || authKey == "index.docker.io" {
+		authKey = "https://index.docker.io/v1/"
+	}
+	if config, err = dockerconfig.Load(dockerconfig.Dir()); err != nil {
+		return
+	}
+	if dockerAuthConfig, err = config.GetAuthConfig(authKey); err != nil {
+		return
+	}
+	authConfig = registrytypes.AuthConfig(dockerAuthConfig)
+	return
+}
+
 // pullImage pulls a container image and outputs progress if --verbose flag is set
 func pullImage(ctx context.Context, docker client.APIClient, image string) error {
-	resp, err := docker.ImagePull(ctx, image, dockerimage.PullOptions{})
+	authConfig, err := resolveAuth(image)
+	if err != nil {
+		l.Log().Warnf("Failed to get auth: %v", err)
+	}
+	encoded, err := registrytypes.EncodeAuthConfig(authConfig)
+	if err != nil {
+		l.Log().Warnf("Failed to encode auth: %v", err)
+	}
+	resp, err := docker.ImagePull(ctx, image, dockerimage.PullOptions{
+		RegistryAuth: encoded,
+	})
 	if err != nil {
 		return fmt.Errorf("docker failed to pull the image '%s': %w", image, err)
 	}