I’m using Sonatype Nexus Repo 3.70 and a little bit confused about Permissions in group vs. hosted repositories.
Is it even possible to set permissions only to the hosted repos but access artifacts over the the group repo?

Following situation: I have 2 hosted docker repositories

• docker-products (restricted access)
• docker-oss (public available)

And a group docker repository

• docker (reachable as https://docker.example.com) including both hosted repos

Now I created privileges

• priv-products: Browse/Read on docker-products
• priv-oss: Browse/Read on docker-oss
• priv-docker: Browse/Read on docker group repo

And assigned the priv-oss to anonymous and priv-products to a user-account

My idea was to have the group repo as main entry point (only a single docker login docker.example.com should be necessary).

If I’m checking the Artifacts (UI) as anonymous user, I see only the oss repo? => So i assigned the priv-docker also to anonymous

Now I see both, but the docker repo contains images from products too (the restricted one) => Bad. Has anyone maybe an idea if how I need to adapt the permissions?