Docker Agent fails to start on Windows because it cannot pull `agentcatalog/coder` with `UNAUTHORIZED`

Description

Docker Agent is installed and docker agent doctor reports the local configuration as healthy, but docker agent run fails before the agent starts because it cannot pull the agentcatalog/coder OCI image from Docker Hub.

I have already confirmed that the model provider configuration is present and valid. Groq is detected correctly, and the model auto-selection resolves to groq/llama-3.3-70b-versatile. However, the runtime still stops at image pull time with an authentication error.

Expected Behavior

docker agent run should start successfully using the configured model and should not fail while pulling agentcatalog/coder.

Actual Behavior

The command fails with:

failed to pull OCI image agentcatalog/coder: resolving remote digest for agentcatalog/coder: GET https://index.docker.io/v2/agentcatalog/coder/manifests/latest: UNAUTHORIZED: authentication required

This happens even after successful docker login and after configuring Groq through docker agent setup.

Steps to Reproduce

1. Install Docker Agent on Windows.
2. Run docker agent setup.
3. Select a cloud provider model and configure GROQ_API_KEY.
4. Confirm the setup with docker agent doctor.
5. Run:

docker agent run --model groq/llama-3.3-70b-versatile

or

docker agent run agentcatalog/pirate

6. Observe that Docker Agent still fails while pulling agentcatalog/coder.

Docker Agent version

v1.115.0

OS & terminal

Windows 11 - PowerShell

Model used

groq/llama-3.3-70b-versatile

Error output

failed to pull OCI image agentcatalog/coder: resolving remote digest for agentcatalog/coder: GET https://index.docker.io/v2/agentcatalog/coder/manifests/latest: UNAUTHORIZED: authentication required

Screenshots

Additional context

docker agent doctor shows:

• user configuration is OK
• GROQ_API_KEY is found in the config env file
• Docker Model Runner is not installed
• model auto-selection resolves to groq/llama-3.3-70b-versatile

Docker login succeeds, but the runtime still cannot pull the required catalog image.