GET and HEAD both, and the 401 carries the challenge.

The containerd image-store resolver (docker 29 with the containerd snapshotter) requests the MANIFEST first and does a HEAD before the GET. The legacy resolver hits /v2/ first, picks the challenge up there and caches a token, so it never needed either. Two consequences, both of which broke pulls on a containerd host while the same registry served a legacy host fine:

• a 401 from Depends(require_read_or_emit) carries no WWW-Authenticate, so containerd has nothing to act on and gives up rather than fetching a token;
• FastAPI does not synthesise HEAD from a GET route, so the HEAD probe got 405.