Error pulling MCP server images when Docker VMM virtual machine option enabled

[Hax7]

When I add AWS Documentation in the MCP catalog and restart Claude Desktop on macOS I get this error in logs:

`- Reading configuration...

• Reading registry from registry.yaml
• Reading catalog from docker-mcp.yaml
• Reading config from config.yaml
• Configuration read in 10.020959ms
• Watching registry at /Users/asmar/.docker/mcp/registry.yaml
• Watching config at /Users/asmar/.docker/mcp/config.yaml
• Those servers are enabled: aws-documentation, git
• Using images:
  • mcp/aws-documentation@sha256:b197e6bf4aaf67e3f9d06dcc793da82cbabede387cc3e33a638cc7a2a155336b
  • mcp/git@sha256:ad6af958e79466a14b895891e772fdda28fdc12c06fff4a70637b66773303a2c
    pulling docker images: pulling docker image mcp/aws-documentation@sha256:b197e6bf4aaf67e3f9d06dcc793da82cbabede387cc3e33a638cc7a2a155336b: Error response from daemon: Get "https://registry-1.docker.io/v2/mcp/aws-documentation/manifests/sha256:b197e6bf4aaf67e3f9d06dcc793da82cbabede387cc3e33a638cc7a2a155336b": unauthorized: incorrect username or password
    2025-07-20T06:18:56.588Z [MCP_DOCKER] [info] Server transport closed { metadata: undefined }
    2025-07-20T06:18:56.588Z [MCP_DOCKER] [info] Client transport closed { metadata: undefined }
    2025-07-20T06:18:56.588Z [MCP_DOCKER] [info] Server transport closed unexpectedly, this is likely due to the process exiting early. If you are developing this MCP server you can add output to stderr (i.e. console.error('...') in JavaScript, print('...', file=sys.stderr) in python) and it will appear in this log. { metadata: undefined }
    2025-07-20T06:18:56.588Z [MCP_DOCKER] [error] Server disconnected. For troubleshooting guidance, please visit our debugging documentation { metadata: { context: 'connection', stack: undefined } }
    2025-07-20T06:18:56.588Z [MCP_DOCKER] [info] Client transport closed { metadata: undefined }`

If you do docker pull for the same image from terminal and restart Claude it would work then. Docker desktop is working and I'm also logged in to docker hub if that matters.

[slimslenderslacks]

@Hax7 can you add a comment with the output of docker mcp version and also send your MCP_DOCKER entry in the claude_desktop_config.json file. You're right that the docker pull initiated by the gateway should be using the same credentials.

[Hax7]

❯ docker mcp version v0.9.9
"MCP_DOCKER":{"command":"docker","args":["mcp","gateway","run"]},
Also when I tried pulling the image in the logs from the terminal it was sized 2.04GB but latest mcp/aws-documentation size is 85.3MB it was not the same digest from latest image for some reason and size is huge

[dgageot]

Hi @Hax7, sorry for breaking your workflow!
On my side, I couldn't reproduce, either with v0.9.9 or the latest.
I see that a new image was pushed 3 days ago. Could it be that it had an issue?
Could you try again?

[Hax7]

Hi @dgageot, I found that if I switch to apple virtualization instead of Docker VMM is starts working fine. I tried to switch back to Docker VMM and it didn't work until I did docker login again(already logged in) so I left like that for a while and then tried to quite Claude Desktop and delete the mcp/aws-documentation image and launched claude again and it failed so I closed it and did docker login again and after that it worked fine. maybe Docker VMM and authentication has a bug?

[dgageot]

Thanks for the feedback @Hax7!

@djs55 do we maybe fail to inject the authorization token when Docker VMM is enabled?

[djs55]

Hi,

To test the auth token injection I tried:

% docker run -it -v /var/run/docker.sock:/var/run/docker.sock docker:cli pull alpine

and then checked ~/Library/Containers/com.docker.docker/Data/log/host/com.docker.backend.log and found:

[2025-07-28T06:31:42.275320384Z][com.docker.backend.init.apiproxy] automatically added X-Registry-Auth header for docker.io pull of library/alpine

@Hax7 the next time you reproduce the bug with Docker VMM, could you upload a set of Docker Desktop diagnostic logs? (see here for instructions) Maybe the auth system is somehow caching a stale token?

Thanks,
Dave

[slimslenderslacks]

For now, I'm going to rename this issue since we're probably investigating image pulls when Docker VMM is enabled.