## Summary Pulling OCI-format images through the Dependency Proxy fails with `failed to decode referrers index: invalid character '<' looking for beginning of value`. Docker 24+ calls the [OCI Referrers API](https://github.com/opencontainers/distribution-spec/blob/main/spec.md#listing-referrers) (`GET /v2/<name>/referrers/<digest>`) when pulling any OCI-format image. The Dependency Proxy has no route for this endpoint, so the request falls through to Rails' HTML 404 page. Docker attempts to parse the HTML as JSON and fails, aborting the pull. This does not affect Docker V2 schema images — the referrers API is only called for OCI images. This explains why the bug has not been widely reported: most commonly pinned CI images (e.g. `node:18`, `python:3.11`) are still served in Docker V2 format on Docker Hub. Related: [Container Virtual Registry has the same gap](https://gitlab.com/gitlab-org/gitlab/-/issues/592700) ## Steps to reproduce 1. Configure the Dependency Proxy for a group 2. Using a Docker client v24 or later, run `docker pull <gitlab-host>/<group>/dependency_proxy/containers/alpine:latest` 3. Observe the pull fail with `failed to decode referrers index: invalid character '<' looking for beginning of value` ## Expected behavior The Dependency Proxy handles `GET /v2/<group>/dependency_proxy/containers/<image>/referrers/<digest>` and returns either an empty OCI image index or a spec-compliant JSON 404. Docker completes the pull successfully. ## Actual behavior The route is not defined. Rails returns an HTML 404. Docker fails to parse it as JSON and aborts the pull with exit code 1. The image is not stored locally. ## Environment - Docker CLI 24+ (tested with Docker 29.2.1) - Any OCI-format image (confirmed with `alpine:latest` and `nginx:latest` from Docker Hub)