diff --git a/docker/docker_client.go b/docker/docker_client.go
index <HASH>..<HASH> 100644
--- a/docker/docker_client.go
+++ b/docker/docker_client.go
@@ -265,8 +265,21 @@ func (c *dockerClient) setupRequestAuth(req *http.Request) error {
 		}
 		chs := parseAuthHeader(res.Header)
 		if res.StatusCode != http.StatusUnauthorized || chs == nil || len(chs) == 0 {
-			// no need for bearer? wtf?
-			return nil
+			// try again one last time with Basic Auth (gcr.io for instance)
+			testReq2 := *req
+			// Do not use the body stream, or we couldn't reuse it for the "real" call later.
+			testReq2.Body = nil
+			testReq2.ContentLength = 0
+			testReq2.SetBasicAuth(c.username, c.password)
+			res, err := c.client.Do(&testReq2)
+			if err != nil {
+				return err
+			}
+			chs = parseAuthHeader(res.Header)
+			if res.StatusCode != http.StatusUnauthorized || chs == nil || len(chs) == 0 {
+				// no need for bearer? wtf?
+				return nil
+			}
 		}
 		// Arbitrarily use the first challenge, there is no reason to expect more than one.
 		challenge := chs[0]
docker: set basic auth when requesting bearer token