- resolve private Docker registry auth automatically for image tag validation pulls when the UI does not provide an explicit registry id - match saved global and node-scoped Docker registries by image reference host before pull and pull-sync operations - prevent container settings tag changes from failing with anonymous registry access on private images