Error: workspace creation with private Docker image and collaborator role

[webkp]

Bug description

I have set up a repository in Gitpod which is using a private Docker image (through .gitpod.yml) and provided the required GITPOD_IMAGE_AUTH var in the Gitpod repository settings. For me as owner, all is working great 👍 I can start workspaces and the image gets loaded.

However, I now added someone with collaborator role to the organization in Gitpod. As collaborator, he can not see (Gitpod's) repository settings (which is great). But when he tried to start a workspace, he got an error:

Workspace cannot be started: Error: 13 INTERNAL: cannot resolve image: failed to authorize: failed to fetch anonymous token: unexpected status from GET request to <URL>: 403 Forbidden

Solution: I had to give him member permission in order to make it work. At least after changing the permission, it started working for him and he was able to create a workspace without any problem.

Steps to reproduce

Set up a Gitpod repository using a private Docker image as per docs: https://www.gitpod.io/docs/configure/workspaces/workspace-image#use-a-private-docker-image

1. Make sure it is working as owner.
2. Add a collaborator
3. Have him start a workspace from the git-repo connected to the repository in Gitlab.

Workspace affected

No response

Expected behavior

I would have expected that a collaborator can start a workspace for which there exists a repository in Gitpod but that he cannot see the settings himself. That would be the optimal solution so that someone can collaborate without having access to all the technical details.

Example repository

No response

Anything else?

Maybe the problem only exists because GITPOD_IMAGE_AUTH is not shared with a user with the collaborator role? But maybe the current behavior is also desired? I haven't found anything about this in the docs.