[Request]: support container registries with separate authentication domains

[AverageMarcus]

Feature or enhancement request details

When logging in to a registry where the authentication server lives on a different domain than the registry itself (e.g. Scaleway's rg.fr-par.scw.cloud -> api.scaleway.com), the login command fails with:

 container registry login rg.fr-par.scw.cloud/namespace -u nologin --password-stdin <<< "$SCW_SECRET_KEY"                                                                                                  

  Error: refusing insecure credential exchange: authorization server api.scaleway.com is not in the same registrable domain as registry rg.fr-par.scw.cloud

Both these domains are valid and expected but Scaleway have chosen to host their authentication service on a different root domain (scaleway.com) to their container registry service (scw.cloud).

It would be great if there was a flag or some sort of allowlist that could be used to indicate that the miss-match in registry & auth domains is expected.

I think the logic that handles the validation of hostnames might actually be in https://github.com/apple/containerization so not sure if you'd prefer the issue created there instead but I figure as it's the login command I'd like to see extended to let the user allow this behaviour it makes sense to start here.

Code of Conduct

• I agree to follow this project's Code of Conduct