Bazel oci_pull fails on 401 for Beam Python SDK

Question

I want to build an Apache Beam SDK image like this:

oci_image(
    name = "move_data_worker_image",
    base = "@beam_python",
    entrypoint = [
        "/opt/apache/beam/boot",
    ],
    tars = [":move_data_layer"],
)

where the base image comes from my WORKSPACE:

# https://hub.docker.com/r/apache/beam_python3.10_sdk/tags
oci_pull(
    name = "beam_python",
    # 2.51.0
    digest = "sha256:af507ee3b2fc7e0ad154c9c0caafdc3c3191886cce36943f40c8f91e776f117e",
    image = "index.docker.io/library/apache/beam_python3.10_sdk",
    # registry = "registry.hub.docker.com",
    # repository = "apache/beam_python3.10_sdk",
)

I was able to do docker pull apache/beam_python3.10_sdk:2.51.0 on the command line. But during Bazel build I get a really weird error:

@beam_python//:beam_python depends on @beam_python_single//:beam_python_single in 
repository @beam_python_single which failed to fetch. no such package '@beam_python_single//': 
curl https://index.docker.io/v2/library/apache/beam_python3.10_sdk/manifests/sha256:af507ee3b2
fc7e0ad154c9c0caafdc3c3191886cce36943f40c8f91e776f117e returned non-success status code 401

On some research I found this un-answered stack post: Bazel's container_pull failing to pull aws-cli image which has very similar errors. So it seems like it's not Beam related. I'm wondering if anyone has seen this before. Thanks!