Issue
When attempting to retrieve a Docker manifest using a curl request for an image that is not yet cached in an Artifactory remote Docker repository, the request returns a 404 MANIFEST_UNKNOWN error.
The expected behavior is that, similar to a docker pull, Artifactory should fetch the requested manifest from the upstream registry (for example, ghcr.io) and return it to the client.
When a Docker remote repository is configured to point to an upstream registry such as ghcr.io or Docker Hub, executing the below curl request to retrieve an image manifest returns a 404 Not Found response, with a MANIFEST_UNKNOWN error, indicating that the requested manifest is not available from the registry.
curl -sS -D - -X GET -H "Authorization: Bearer " -H "Accept: application/vnd.docker.distribution.manifest.list.v2+json, application/vnd.docker.distribution.manifest.v2+json, "https://<Artifactory-Url>/v2/docker/${IMAGE_PATH}/manifests/${TAG}"
output:
HTTP/1.1 404 Not Found
Date: Tue, 23 Jun 2026 04:03:55 GMT
Content-Type: application/json
Transfer-Encoding: chunked
Connection: keep-alive
Docker-Distribution-Api-Version: registry/2.0
X-Artifactory-Id: e1706868ca224e7b:-66122159:19ef27979ab:-8000
X-Artifactory-Node-Id: ebabfc12788d
X-Jfrog-Version: Artifactory/7.146.10 84610900
{"errors":[{"code":"MANIFEST_UNKNOWN","message":"The named manifest is not known to the registry.","detail":{"manifest":"docker/test"}}]}%
Root Cause
The image hosted on GHCR is stored as an OCI manifest. However, the curl request advertises support only for Docker manifest media types in the Accept header.
Artifactory forwards the client's Accept header to the upstream registry. Since the request does not indicate support for OCI manifests, GHCR responds with:
OCI manifest found, but Accept header does not support OCI manifests.
As a result, Artifactory returns a 404 MANIFEST_UNKNOWN response.
This also explains why docker pull succeeds. The Docker client automatically includes both Docker and OCI media types in its Accept header, whereas the manually constructed curl request only includes Docker media types.
Solution
Since this is a client behaviour [ curl ] and not an Artifactory issue, please update your Curl request to Accept the header to include the OCI media types used by the Docker client.
application/vnd.oci.image.index.v1+json,
application/vnd.oci.image.manifest.v1+json
Curl command to retrieve Docker tags for images that are not yet cached in the Artifactory repository with headers to include OCI Media types.
curl -sS -D - -X GET -H "Authorization: Bearer " -H "Accept: application/vnd.docker.distribution.manifest.list.v2+json, application/vnd.docker.distribution.manifest.v2+json, application/vnd.oci.image.index.v1+json, application/vnd.oci.image.manifest.v1+json" "https://<Artifactory-Url>/v2/docker/${IMAGE_PATH}/manifests/${TAG}"
With the OCI media types included, Artifactory can successfully negotiate the manifest format with the upstream registry and retrieve manifests for images that are not yet cached.