Docker login is inconsistent for library scopes

Description

I have the following docker image:

docker.io/mylib/myname@sha256:XYZ

I try to login via:

docker login docker.io/mylib/myname@sha256:XYZ

After providing the correct credentials the login is working correctly.

Then I try to pull the image via

docker pull docker.io/mylib/myname@sha256:XYZ

This fails with an access denied error.

Then I login via

docker login docker.io

Again this succeeds and now the subsequent pull succeeds as well.

Describe the results you received:

Despite a seemingly successful login using the full image identifier I cannot pull the image.

Describe the results you expected:

I would expect to be able to login to the image identifier and after a successful login pull the image.

Additional information you deem important (e.g. issue happens only occasionally):

It turns out that the content for the ~/.docker/config.json file is different depending on how I login.

When logging in like this:

docker login
docker login docker.io

The key in the auths section is https://index.docker.io/v1/

When logging in like this:

docker login docker.io/mylib/myname@sha256:XYZ
docker login docker.io/mylib

The key in the auths section is docker.io

A subsequent pull will only work if the key is https://index.docker.io/v1/.

This is inconsistent compared to private registries, where the key is always the hostname and a pull works successfully in that case.

Output of docker version:

docker version
Client:
 Version:           20.10.12
 API version:       1.41
 Go version:        go1.16.2
 Git commit:        20.10.12-0ubuntu2~20.04.1
 Built:             Wed Apr  6 02:14:50 2022
 OS/Arch:           linux/s390x
 Context:           default
 Experimental:      true

Server:
 Engine:
  Version:          20.10.12
  API version:      1.41 (minimum version 1.12)
  Go version:       go1.16.2
  Git commit:       20.10.12-0ubuntu2~20.04.1
  Built:            Thu Feb 10 15:03:35 2022
  OS/Arch:          linux/s390x
  Experimental:     false
 containerd:
  Version:          1.5.9-0ubuntu1~20.04.4
  GitCommit:
 runc:
  Version:          1.1.0-0ubuntu1~20.04.1
  GitCommit:
 docker-init:
  Version:          0.19.0
  GitCommit:

Output of docker info:

docker info
Client:
 Context:    default
 Debug Mode: false
 Plugins:
  compose: Docker Compose (Docker Inc., v2.4.1)

Server:
 Containers: 0
  Running: 0
  Paused: 0
  Stopped: 0
 Images: 0
 Server Version: 20.10.12
 Storage Driver: overlay2
  Backing Filesystem: extfs
  Supports d_type: true
  Native Overlay Diff: true
  userxattr: false
 Logging Driver: journald
 Cgroup Driver: cgroupfs
 Cgroup Version: 1
 Plugins:
  Volume: local
  Network: bridge host ipvlan macvlan null overlay
  Log: awslogs fluentd gcplogs gelf journald json-file local logentries splunk syslog
 Swarm: inactive
 Runtimes: io.containerd.runc.v2 io.containerd.runtime.v1.linux runc
 Default Runtime: runc
 Init Binary: docker-init
 containerd version:
 runc version:
 init version:
 Security Options:
  apparmor
  seccomp
   Profile: default
 Kernel Version: 5.4.0-113-generic
 Operating System: Ubuntu 20.04.4 LTS
 OSType: linux
 Architecture: s390x
 CPUs: 1
 Total Memory: 3.411GiB
 Name: kalai1234
 ID: LAZJ:G3T2:A747:SRDE:C2PJ:MTUA:TL7M:ZGXV:XPP7:E4WD:Q6X3:YHPA
 Docker Root Dir: /var/lib/docker
 Debug Mode: false
 Username: redbooksuser1
 Registry: https://index.docker.io/v1/
 Labels:
 Experimental: false
 Insecure Registries:
  127.0.0.0/8
 Live Restore Enabled: false

WARNING: No swap limit support

Reproduce the documented docker login and docker pull commands, then compare the resulting ~/.docker/config.json auths keys. Trace how image identifiers and registry scopes are normalized for Docker Hub versus private registries. Done means logging in with the image identifier produces credentials that the subsequent pull can use consistently.