docker_image cannot update images without the force flag

[xrl]

ISSUE TYPE

Feature Idea

COMPONENT NAME

cloud/docker/docker_image

ANSIBLE VERSION

ansible 2.1.0.0
  config file = /Users/xlange/code/viasat/itsec-config/ansible/ansible.cfg
  configured module search path = Default w/o overrides

CONFIGURATION

OS / ENVIRONMENT

OSX to Linux CoreOS

SUMMARY

I need to register the output of docker_image and it never updates the image. I want to perform actions when my registry has new images then use docker_container to re-create the container. Without docker_image producing result.changed = true when new image builds are present I cannot safely proceed. Setting force = true on the docker_image task is also not very friendly -- it will always say result.changed = true when the force flag is set.

I have read over the module code and the behavior is similar to how the code is written. The code needs to be modified to allow pulls for image updates.

STEPS TO REPRODUCE

1. Have a docker container running
2. Push updated image to your registry
3. Run docker_image to pull that update
4. Watch the registered value, it will show "changed: false" and the docker images command will show the old image.

- name: Pull latest Elasticsearch docker image
  docker_image:
    docker_api_version: auto
    name: registry.cloud/elasticsearch
    tag: scb
    state: present
  register: es_image
- name: Debug
  debug: msg="{{es_image}}"

EXPECTED RESULTS

The updated image should have been pulled down and the result.changed = true should have been set.

ACTUAL RESULTS

Changed was false. The work around is to set force: true but that is not smart about whether a change or not actually occured. It does pull down the update.

[ansibot]

@ansible ping, this issue is waiting for your response.
click here for bot help

[chouseknecht]

docker_image currently works the way the documentation reads. If the image exists locally, a new image will not be pulled, unless force is set.

To do what you're asking, docker_image would need to query the registry API directly to get the image manifest. To determine if the image should be pulled, it would simply compare the image Id in the manifest to the local image Id. That's probably not super difficult to do.

In the meantime... the v2 registry includes a notification web hook that could be pointed to a CI/CD server to execute a playbook whenever a new image is pushed to the registry.

[chouseknecht]

wontfix

Marking as wonfix because adding this functionality is not a priority. It may be nice to have, and If the community would like to add it, a PR would be appreciated.

[stonier]

+1 as a nice to have.

We could certainly use it, and to be honest, the current setup is unintuitive and took me 20-30 minutes of debugging to work out that force: no doesn't behave as expected, i.e. a changed image id does not download.

I am not knowledgeable enough about the details to make a PR, but at the very least, I think the docker_image documentation should be updated so that the unexpected behaviour can be understood upon going to the documentation and before running several experiments.

[viggeh]

As a workaround you can check the image Id that was just pulled against the id that you already have for the image and mess with the changed_when parameter

# this is a workaround for https://github.com/ansible/ansible-modules-core/issues/4371 until
# https://github.com/ansible/ansible/pull/19235 gets merged
# we need to know which image the container is using so that we can know if a new image is available
- name: get id of image
  command: 'docker images --format {%raw%}"{{.ID}}"{%endraw%} --no-trunc {{docker_image_name}}:{{docker_image_tag}}'
  register: imageid
  changed_when: imageid.rc != 0

- name: pull docker image
  docker_image:    
    name: "{{docker_image_name}}"
    state: present    
    tag: "{{ docker_image_tag }}"
    # we set this force parameter as true so that the latest version of the image tag is pulled
    force: true  
  register: image_pull  
  # we compare the id of the image we already had with the id of the image we just pulled.
  # If they are different then image_pull.changed will be true
  changed_when: imageid.stdout != image_pull.image.Id