Why Docker pushes to Artifact Registry time out at exactly 60 seconds

TL;DR Link to heading Our image pushes from GitHub Actions to Google Artifact Registry kept failing with failed to authorize: DeadlineExceeded: context deadline exceeded, always about 60 seconds into the push, and usually passing on a rerun. The 60 seconds is BuildKit’s limit on how long it waits for the buildx client to hand back a registry token. The client asks Artifact Registry for that token with a POST first. Artifact Registry doesn’t support it and answers 405, which normally takes 20ms, after which the client falls back to a GET that works. Occasionally the 405 reply never finishes, the client sits on it until BuildKit gives up, and the GET never runs. Setting BUILDKIT_NO_CLIENT_TOKEN=1 where buildx runs makes BuildKit fetch tokens itself, and BuildKit tries GET first.