## Summary Pulling OCI-format images through the Container Virtual Registry fails with `failed to decode referrers index: invalid character '<' looking for beginning of value`. Docker 24+ calls the [OCI Referrers API](https://github.com/opencontainers/distribution-spec/blob/main/spec.md#listing-referrers) (`GET /v2/<name>/referrers/<digest>`) when pulling any OCI-format image. The virtual registry has no route for this endpoint, so the request falls through to Rails' HTML 404 page. Docker attempts to parse the HTML as JSON and fails, aborting the pull. This does not affect Docker V2 schema images (e.g. `application/vnd.docker.distribution.manifest.list.v2+json`) — the referrers API is only called for OCI images. ## Steps to reproduce 1. Create a Container Virtual Registry with an upstream pointing to Docker Hub (`https://registry-1.docker.io`) 2. Run `docker pull <gitlab-host>/virtual_registries/containers/<id>/library/nginx:latest` - _NOTE: Old version that does not implement OCI format: nginx:1.23_ 3. Observe the pull fail with `failed to decode referrers index: invalid character '<' looking for beginning of value` ## Expected behavior The virtual registry handles `GET /v2/virtual_registries/containers/:id/*image_name/referrers/:digest` and returns either: - An empty OCI image index (`{"schemaVersion":2,"mediaType":"application/vnd.oci.image.index.v1+json","manifests":[]}`) with `Content-Type: application/vnd.oci.image.index.v1+json`, or - A spec-compliant JSON 404 error Docker then continues the pull successfully. ## Actual behavior The route is not defined, so Rails returns an HTML 404. Docker fails to parse this as JSON and aborts the pull with exit code 1. ## Root cause The route definition at `ee/config/routes/virtual_registries_container.rb` only handles `manifests/` and `blobs/` path suffixes. The `referrers/` path is absent. ## Environment - Docker 29.2.1 (reproduces with any Docker 24+) - Any OCI-format image (confirmed with `library/nginx:latest` from Docker Hub)