c8d: The authorizer needs to be set even if AuthConfig is empty
**- What I did**

Without the authorizer pulling will fail if the user is not logged-in. 

Fixes #45529

Relates to #45517

**- How I did it**

We now only check if the auth config is nil (it actually never is), we don't check if it's empty.

**- How to verify it**

```console
$ docker logout
$ docker pull hello-world
```

**- Description for the changelog**
<!--
Write a short (one line) summary that describes the changes in this
pull request for inclusion in the changelog:
-->


**- A picture of a cute animal (not mandatory but encouraged)**


daemon/containerd/resolver.go
package containerd

import (
	"crypto/tls"
	"errors"
	"net/http"

	"github.com/containerd/containerd/remotes"
	"github.com/containerd/containerd/remotes/docker"
	registrytypes "github.com/docker/docker/api/types/registry"
	"github.com/docker/docker/registry"
	"github.com/sirupsen/logrus"
)

func (i *ImageService) newResolverFromAuthConfig(authConfig *registrytypes.AuthConfig) (remotes.Resolver, docker.StatusTracker) {
	tracker := docker.NewInMemoryTracker()
	hostsFn := i.registryHosts.RegistryHosts()

	hosts := hostsWrapper(hostsFn, authConfig, i.registryService)

	return docker.NewResolver(docker.ResolverOptions{
		Hosts:   hosts,
		Tracker: tracker,
	}), tracker
}

func hostsWrapper(hostsFn docker.RegistryHosts, optAuthConfig *registrytypes.AuthConfig, regService RegistryConfigProvider) docker.RegistryHosts {
	var authorizer docker.Authorizer
	if optAuthConfig != nil {
		auth := *optAuthConfig
		if auth != (registrytypes.AuthConfig{}) {
			authorizer = docker.NewDockerAuthorizer(authorizationCredsFromAuthConfig(auth))
		}
	}

	return func(n string) ([]docker.RegistryHost, error) {
		hosts, err := hostsFn(n)
		if err != nil {
			return nil, err
		}

		for i := range hosts {
			if hosts[i].Authorizer == nil {
				hosts[i].Authorizer = authorizer
				isInsecure := regService.IsInsecureRegistry(hosts[i].Host)
				if hosts[i].Client.Transport != nil && isInsecure {
					hosts[i].Client.Transport = httpFallback{super: hosts[i].Client.Transport}
				}
			}
		}
		return hosts, nil
	}
}

func authorizationCredsFromAuthConfig(authConfig registrytypes.AuthConfig) docker.AuthorizerOpt {
	cfgHost := registry.ConvertToHostname(authConfig.ServerAddress)
	if cfgHost == "" || cfgHost == registry.IndexHostname {
		cfgHost = registry.DefaultRegistryHost
	}

	return docker.WithAuthCreds(func(host string) (string, string, error) {
		if cfgHost != host {
			logrus.WithFields(logrus.Fields{
				"host":    host,
				"cfgHost": cfgHost,
			}).Warn("Host doesn't match")
			return "", "", nil
		}
		if authConfig.IdentityToken != "" {
			return "", authConfig.IdentityToken, nil
		}
		return authConfig.Username, authConfig.Password, nil
	})
}

type httpFallback struct {
	super http.RoundTripper
}

func (f httpFallback) RoundTrip(r *http.Request) (*http.Response, error) {
	resp, err := f.super.RoundTrip(r)
	var tlsErr tls.RecordHeaderError
	if errors.As(err, &tlsErr) && string(tlsErr.RecordHeader[:]) == "HTTP/" {
		// server gave HTTP response to HTTPS client
		plainHttpUrl := *r.URL
		plainHttpUrl.Scheme = "http"

		plainHttpRequest := *r
		plainHttpRequest.URL = &plainHttpUrl

		return http.DefaultTransport.RoundTrip(&plainHttpRequest)
	}

	return resp, err
}

package containerd

import (
	"crypto/tls"
	"errors"
	"net/http"

	"github.com/containerd/containerd/remotes"
	"github.com/containerd/containerd/remotes/docker"
	registrytypes "github.com/docker/docker/api/types/registry"
	"github.com/docker/docker/registry"
	"github.com/sirupsen/logrus"
)

func (i *ImageService) newResolverFromAuthConfig(authConfig *registrytypes.AuthConfig) (remotes.Resolver, docker.StatusTracker) {
	tracker := docker.NewInMemoryTracker()
	hostsFn := i.registryHosts.RegistryHosts()

	hosts := hostsWrapper(hostsFn, authConfig, i.registryService)

	return docker.NewResolver(docker.ResolverOptions{
		Hosts:   hosts,
		Tracker: tracker,
	}), tracker
}

func hostsWrapper(hostsFn docker.RegistryHosts, optAuthConfig *registrytypes.AuthConfig, regService RegistryConfigProvider) docker.RegistryHosts {
	var authorizer docker.Authorizer
	if optAuthConfig != nil {
		authorizer = docker.NewDockerAuthorizer(authorizationCredsFromAuthConfig(*optAuthConfig))
	}

	return func(n string) ([]docker.RegistryHost, error) {
		hosts, err := hostsFn(n)
		if err != nil {
			return nil, err
		}

		for i := range hosts {
			if hosts[i].Authorizer == nil {
				hosts[i].Authorizer = authorizer
				isInsecure := regService.IsInsecureRegistry(hosts[i].Host)
				if hosts[i].Client.Transport != nil && isInsecure {
					hosts[i].Client.Transport = httpFallback{super: hosts[i].Client.Transport}
				}
			}
		}
		return hosts, nil
	}
}

func authorizationCredsFromAuthConfig(authConfig registrytypes.AuthConfig) docker.AuthorizerOpt {
	cfgHost := registry.ConvertToHostname(authConfig.ServerAddress)
	if cfgHost == "" || cfgHost == registry.IndexHostname {
		cfgHost = registry.DefaultRegistryHost
	}

	return docker.WithAuthCreds(func(host string) (string, string, error) {
		if cfgHost != host {
			logrus.WithFields(logrus.Fields{
				"host":    host,
				"cfgHost": cfgHost,
			}).Warn("Host doesn't match")
			return "", "", nil
		}
		if authConfig.IdentityToken != "" {
			return "", authConfig.IdentityToken, nil
		}
		return authConfig.Username, authConfig.Password, nil
	})
}

type httpFallback struct {
	super http.RoundTripper
}

func (f httpFallback) RoundTrip(r *http.Request) (*http.Response, error) {
	resp, err := f.super.RoundTrip(r)
	var tlsErr tls.RecordHeaderError
	if errors.As(err, &tlsErr) && string(tlsErr.RecordHeader[:]) == "HTTP/" {
		// server gave HTTP response to HTTPS client
		plainHttpUrl := *r.URL
		plainHttpUrl.Scheme = "http"

		plainHttpRequest := *r
		plainHttpRequest.URL = &plainHttpUrl

		return http.DefaultTransport.RoundTrip(&plainHttpRequest)
	}

	return resp, err
}

With curl, the logs look the same, no warnings, no errors:

```
DEBU[2023-05-12T10:16:13.229744346+02:00] resolving                                     host=registry-1.docker.io
DEBU[2023-05-12T10:16:13.229794680+02:00] do request                                    host=registry-1.docker.io request.header.accept="application/vnd.docker.distribution.manifest.v2+json, application/vnd.docker.distribution.manifest.list.v2+json, application/vnd.oci.image.manifest.v1+json, application/vnd.oci.image.index.v1+json, */*" request.header.user-agent=containerd/1.6.21+unknown request.method=HEAD url="https://registry-1.docker.io/v2/library/hello-world/manifests/latest"
DEBU[2023-05-12T10:16:13.674409118+02:00] fetch response received                       host=registry-1.docker.io response.header.content-length=162 response.header.content-type=application/json response.header.date="Fri, 12 May 2023 08:16:13 GMT" response.header.docker-distribution-api-version=registry/2.0 response.header.docker-ratelimit-source=62.35.48.5 response.header.strict-transport-security="max-age=31536000" response.header.www-authenticate="Bearer realm=\"https://auth.docker.io/token\",service=\"registry.docker.io\",scope=\"repository:library/hello-world:pull\"" response.status="401 Unauthorized" url="https://registry-1.docker.io/v2/library/hello-world/manifests/latest"
DEBU[2023-05-12T10:16:13.674764702+02:00] Unauthorized                                  header="Bearer realm=\"https://auth.docker.io/token\",service=\"registry.docker.io\",scope=\"repository:library/hello-world:pull\"" host=registry-1.docker.io
DEBU[2023-05-12T10:16:13.674910619+02:00] do request                                    host=registry-1.docker.io request.header.accept="application/vnd.docker.distribution.manifest.v2+json, application/vnd.docker.distribution.manifest.list.v2+json, application/vnd.oci.image.manifest.v1+json, application/vnd.oci.image.index.v1+json, */*" request.header.user-agent=containerd/1.6.21+unknown request.method=HEAD url="https://registry-1.docker.io/v2/library/hello-world/manifests/latest"
DEBU[2023-05-12T10:16:14.541149961+02:00] fetch response received                       host=registry-1.docker.io response.header.content-length=2561 response.header.content-type=application/vnd.docker.distribution.manifest.list.v2+json response.header.date="Fri, 12 May 2023 08:16:14 GMT" response.header.docker-content-digest="sha256:fc6cf906cbfa013e80938cdf0bb199fbdbb86d6e3e013783e5a766f50f5dbce0" response.header.docker-distribution-api-version=registry/2.0 response.header.docker-ratelimit-source=62.35.48.5 response.header.etag="\"sha256:fc6cf906cbfa013e80938cdf0bb199fbdbb86d6e3e013783e5a766f50f5dbce0\"" response.header.ratelimit-limit="100;w=21600" response.header.ratelimit-remaining="96;w=21600" response.header.strict-transport-security="max-age=31536000" response.status="200 OK" url="https://registry-1.docker.io/v2/library/hello-world/manifests/latest"
DEBU[2023-05-12T10:16:14.541483211+02:00] resolved                                      desc.digest="sha256:fc6cf906cbfa013e80938cdf0bb199fbdbb86d6e3e013783e5a766f50f5dbce0" host=registry-1.docker.io
DEBU[2023-05-12T10:16:14.553085854+02:00] fetch                                         digest="sha256:fc6cf906cbfa013e80938cdf0bb199fbdbb86d6e3e013783e5a766f50f5dbce0" mediatype=application/vnd.docker.distribution.manifest.list.v2+json size=2561
DEBU[2023-05-12T10:16:14.569229546+02:00] do request                                    digest="sha256:fc6cf906cbfa013e80938cdf0bb199fbdbb86d6e3e013783e5a766f50f5dbce0" mediatype=application/vnd.docker.distribution.manifest.list.v2+json request.header.accept="application/vnd.docker.distribution.manifest.list.v2+json, */*" request.header.user-agent=containerd/1.6.21+unknown request.method=GET size=2561 url="https://registry-1.docker.io/v2/library/hello-world/manifests/sha256:fc6cf906cbfa013e80938cdf0bb199fbdbb86d6e3e013783e5a766f50f5dbce0"
DEBU[2023-05-12T10:16:14.879545235+02:00] fetch response received                       digest="sha256:fc6cf906cbfa013e80938cdf0bb199fbdbb86d6e3e013783e5a766f50f5dbce0" mediatype=application/vnd.docker.distribution.manifest.list.v2+json response.header.content-length=2561 response.header.content-type=application/vnd.docker.distribution.manifest.list.v2+json response.header.date="Fri, 12 May 2023 08:16:14 GMT" response.header.docker-content-digest="sha256:fc6cf906cbfa013e80938cdf0bb199fbdbb86d6e3e013783e5a766f50f5dbce0" response.header.docker-distribution-api-version=registry/2.0 response.header.docker-ratelimit-source=62.35.48.5 response.header.etag="\"sha256:fc6cf906cbfa013e80938cdf0bb199fbdbb86d6e3e013783e5a766f50f5dbce0\"" response.header.ratelimit-limit="100;w=21600" response.header.ratelimit-remaining="96;w=21600" response.header.strict-transport-security="max-age=31536000" response.status="200 OK" size=2561 url="https://registry-1.docker.io/v2/library/hello-world/manifests/sha256:fc6cf906cbfa013e80938cdf0bb199fbdbb86d6e3e013783e5a766f50f5dbce0"
DEBU[2023-05-12T10:16:14.907173278+02:00] fetch                                         digest="sha256:efebf0f7aee69450f99deafe11121afa720abed733943e50581a9dc7540689c8" mediatype=application/vnd.docker.distribution.manifest.v2+json size=525
DEBU[2023-05-12T10:16:14.912665953+02:00] do request                                    digest="sha256:efebf0f7aee69450f99deafe11121afa720abed733943e50581a9dc7540689c8" mediatype=application/vnd.docker.distribution.manifest.v2+json request.header.accept="application/vnd.docker.distribution.manifest.v2+json, */*" request.header.user-agent=containerd/1.6.21+unknown request.method=GET size=525 url="https://registry-1.docker.io/v2/library/hello-world/manifests/sha256:efebf0f7aee69450f99deafe11121afa720abed733943e50581a9dc7540689c8"
DEBU[2023-05-12T10:16:15.166872138+02:00] fetch response received                       digest="sha256:efebf0f7aee69450f99deafe11121afa720abed733943e50581a9dc7540689c8" mediatype=application/vnd.docker.distribution.manifest.v2+json response.header.content-length=525 response.header.content-type=application/vnd.docker.distribution.manifest.v2+json response.header.date="Fri, 12 May 2023 08:16:15 GMT" response.header.docker-content-digest="sha256:efebf0f7aee69450f99deafe11121afa720abed733943e50581a9dc7540689c8" response.header.docker-distribution-api-version=registry/2.0 response.header.docker-ratelimit-source=62.35.48.5 response.header.etag="\"sha256:efebf0f7aee69450f99deafe11121afa720abed733943e50581a9dc7540689c8\"" response.header.ratelimit-limit="100;w=21600" response.header.ratelimit-remaining="95;w=21600" response.header.strict-transport-security="max-age=31536000" response.status="200 OK" size=525 url="https://registry-1.docker.io/v2/library/hello-world/manifests/sha256:efebf0f7aee69450f99deafe11121afa720abed733943e50581a9dc7540689c8"
DEBU[2023-05-12T10:16:15.190582425+02:00] fetch                                         digest="sha256:b038788ddb222cb7d6025b411759e4f5abe9910486c8f98534ead97befd77dd7" mediatype=application/vnd.docker.container.image.v1+json size=1485
DEBU[2023-05-12T10:16:15.195648974+02:00] do request                                    digest="sha256:b038788ddb222cb7d6025b411759e4f5abe9910486c8f98534ead97befd77dd7" mediatype=application/vnd.docker.container.image.v1+json request.header.accept="application/vnd.docker.container.image.v1+json, */*" request.header.user-agent=containerd/1.6.21+unknown request.method=GET size=1485 url="https://registry-1.docker.io/v2/library/hello-world/blobs/sha256:b038788ddb222cb7d6025b411759e4f5abe9910486c8f98534ead97befd77dd7"
DEBU[2023-05-12T10:16:15.593071215+02:00] fetch response received                       digest="sha256:b038788ddb222cb7d6025b411759e4f5abe9910486c8f98534ead97befd77dd7" mediatype=application/vnd.docker.container.image.v1+json response.header.accept-ranges=bytes response.header.age=687240 response.header.cache-control="public, max-age=14400" response.header.cf-cache-status=HIT response.header.cf-ray=7c6137f15d740232-CDG response.header.connection=keep-alive response.header.content-length=1485 response.header.content-type=application/octet-stream response.header.date="Fri, 12 May 2023 08:16:15 GMT" response.header.etag="\"4c8c8c3827591cf7643245910181ba11\"" response.header.expires="Fri, 12 May 2023 12:16:15 GMT" response.header.last-modified="Thu, 04 May 2023 08:43:33 GMT" response.header.server=cloudflare response.header.vary=Accept-Encoding response.header.x-amz-id-2="kDNqB7+tawkeCGlaL99CjxxO5LfeAgCKd6Bly8Mo9I/BcaGKRjWZvsUoQjMia0p7w9QE9b6JtF8=" response.header.x-amz-request-id=8X9SW8SYGGJV1RA4 response.header.x-amz-server-side-encryption=AES256 response.header.x-amz-version-id=UbWK6i2XuagOLBKXZZ5a3JY1SIrQleVV response.status="200 OK" size=1485 url="https://registry-1.docker.io/v2/library/hello-world/blobs/sha256:b038788ddb222cb7d6025b411759e4f5abe9910486c8f98534ead97befd77dd7"
DEBU[2023-05-12T10:16:15.623646762+02:00] fetch                                         digest="sha256:70f5ac315c5af948332962ff4678084ebcc215809506e4b8cd9e509660417205" mediatype=application/vnd.docker.image.rootfs.diff.tar.gzip size=3190
DEBU[2023-05-12T10:16:15.627115851+02:00] do request                                    digest="sha256:70f5ac315c5af948332962ff4678084ebcc215809506e4b8cd9e509660417205" mediatype=application/vnd.docker.image.rootfs.diff.tar.gzip request.header.accept="application/vnd.docker.image.rootfs.diff.tar.gzip, */*" request.header.user-agent=containerd/1.6.21+unknown request.method=GET size=3190 url="https://registry-1.docker.io/v2/library/hello-world/blobs/sha256:70f5ac315c5af948332962ff4678084ebcc215809506e4b8cd9e509660417205"
DEBU[2023-05-12T10:16:15.743734573+02:00] fetch response received                       digest="sha256:70f5ac315c5af948332962ff4678084ebcc215809506e4b8cd9e509660417205" mediatype=application/vnd.docker.image.rootfs.diff.tar.gzip response.header.accept-ranges=bytes response.header.age=687240 response.header.cache-control="public, max-age=14400" response.header.cf-cache-status=HIT response.header.cf-ray=7c6137f26e800232-CDG response.header.connection=keep-alive response.header.content-length=3190 response.header.content-type=application/octet-stream response.header.date="Fri, 12 May 2023 08:16:15 GMT" response.header.etag="\"77c5682f99e7f7e214256ec3fec2d80e\"" response.header.expires="Fri, 12 May 2023 12:16:15 GMT" response.header.last-modified="Thu, 04 May 2023 08:43:30 GMT" response.header.server=cloudflare response.header.vary=Accept-Encoding response.header.x-amz-id-2="7oSha/0hqZvM8qYxKdSAcoW/ZJzZf82ZytX8QhF9QtUHS4kkRPUC5qXay5mY23CDJd6dppsHz7Q=" response.header.x-amz-request-id=DT5M7981WMA3MBX1 response.header.x-amz-server-side-encryption=AES256 response.header.x-amz-version-id=90uK7t_hJMfKcra6WhJnrRqgn1IaMC3b response.status="200 OK" size=3190 url="https://registry-1.docker.io/v2/library/hello-world/blobs/sha256:70f5ac315c5af948332962ff4678084ebcc215809506e4b8cd9e509660417205"
DEBU[2023-05-12T10:16:15.778144252+02:00] image unpacked                                chainID="sha256:a7866053acacfefb68912a8916b67d6847c12b51949c6b8a5580c6609c08ae45" config="sha256:b038788ddb222cb7d6025b411759e4f5abe9910486c8f98534ead97befd77dd7"
INFO[2023-05-12T10:16:15.780714172+02:00] image pulled                                  digest="sha256:fc6cf906cbfa013e80938cdf0bb199fbdbb86d6e3e013783e5a766f50f5dbce0" remote="docker.io/library/hello-world:latest"
```