title: Download manifest of private repository from Docker Registry API
body: <p>Normally, e.g., for the alpine image, we obtain an auth token via:</p>
  
  <pre><code>curl -i "https://auth.docker.io/token?service=registry.docker.io&amp;scope=repository:library/alpine:pull"
  </code></pre>
  
  <p>Then we can use it to obtain the manifest from the registry:</p>
  
  <pre><code>curl -i -H "Authorization: Bearer $TOKEN" -H "Accept: application/vnd.docker.distribution.manifest.list.v2+json" https://registry-1.docker.io/v2/library/alpine/manifests/latest
  </code></pre>
  
  <p>When we replace library/alpine with a private repository of ours (ourcompany/ourrepo) obtaining a token still works, however, downloading the manifest results in:</p>
  
  <pre><code>HTTP/1.1 401 Unauthorized
  Content-Type: application/json
  Docker-Distribution-Api-Version: registry/2.0
  Www-Authenticate: Bearer realm="https://auth.docker.io/token",service="registry.docker.io",scope="repository:ourcompany/ourrepo:pull",error="insufficient_scope"
  Date: Tue, 26 May 2020 10:32:56 GMT
  Content-Length: 168
  Strict-Transport-Security: max-age=31536000
  
  {"errors":[{"code":"UNAUTHORIZED","message":"authentication required","detail":[{"Type":"repository","Class":"","Name":"ourcompany/ourrepo","Action":"pull"}]}]}
  </code></pre>
  
  <p>How to circumvent this 401 error? </p>
  
  <p>Do we need to obtain additional tokens? Send authentication credentials in addition? Do something completely differently?</p>