service.update() doesn't pull the latest image tag version

[tlex]

I'm trying to update a service to the latest build for the image tag (in my case, the latest build for :latest).

Running the following code:

import docker

client = docker.from_env()

services = client.services.list(filters={'name': 'smtp_smtp'})

for service in services:
    image_with_digest = service.attrs['Spec']['TaskTemplate']['ContainerSpec']['Image']
    image = image_with_digest.split('@', 1)[0]
    service.update(image=image)

Running the above script triggers the following event in docker:

$ docker events
2019-08-31T15:06:37.473139584+02:00 service update pqs6wtscm1tq6yiqrmu4wv0of (name=smtp_smtp)

On the other hand, doing the same but with the docker CLI:

import subprocess
import docker

client = docker.from_env()

services = client.services.list(filters={'name': 'smtp_smtp'})

for service in services:
    image_with_digest = service.attrs['Spec']['TaskTemplate']['ContainerSpec']['Image']
    image = image_with_digest.split('@', 1)[0]
    subprocess.run(
        args=['docker', 'service', 'update', '--image={}'.format(image), service.id],
        check=True,
    )

Docker events:

2019-08-31T15:11:02.408583705+02:00 service update pqs6wtscm1tq6yiqrmu4wv0of (image.new=registry.gitlab.com/ix.ai/smtp:latest@sha256:150a586ac5b572200231f129a22e7dedc5443e7e3e567a7041c90bf260be13e6, image.old=registry.gitlab.com/ix.ai/smtp:latest, name=smtp_smtp)
2019-08-31T15:11:02.410705349+02:00 service update pqs6wtscm1tq6yiqrmu4wv0of (name=smtp_smtp, updatestate.new=updating)
[...]

Needless to say, I ensured that there was indeed a newer version of the :latest tag in the registry.

I suspect that the Python SDK is interacting differently with the docker daemon than the CLI client, but I couldn't find any way to actually compare the actual requests. I can see that the CLI is automatically setting the SHA256 in the Spec.TaskTemplate.ContainerSpec.Image, while docker-py does not:

"ContainerSpec": {
    "Image": "registry.gitlab.com/ix.ai/smtp:latest@sha256:e1e6502c2cc2925ba2c8ccaddf994609e660748bc2419dc9d550ce4deba8d8d9",
    "Labels": {
        "com.docker.stack.namespace": "smtp"
    },
[...]
}

Version information

$ pip freeze | grep docker && python --version && docker version
docker==4.0.2
docker-pycreds==0.4.0
Python 3.7.4
Client: Docker Engine - Community
 Version:           19.03.1
 API version:       1.40
 Go version:        go1.12.5
 Git commit:        74b1e89
 Built:             Thu Jul 25 21:18:17 2019
 OS/Arch:           darwin/amd64
 Experimental:      false

Server: Docker Engine - Community
 Engine:
  Version:          19.03.1
  API version:      1.40 (minimum version 1.12)
  Go version:       go1.12.5
  Git commit:       74b1e89
  Built:            Thu Jul 25 21:17:52 2019
  OS/Arch:          linux/amd64
  Experimental:     true
 containerd:
  Version:          v1.2.6
  GitCommit:        894b81a4b802e4eb2a91d1ce216b8817763c29fb
 runc:
  Version:          1.0.0-rc8
  GitCommit:        425e105d5a03fabd737a126ad93d62a9eeede87f
 docker-init:
  Version:          0.18.0
  GitCommit:        fec3683

[feliperuhland]

Hi @tlex

Can you try service.force_update()?

In my tests, both (CLI and Dockerpy) services didn't update using only service.update(...), but with force_update the image was pulled and the service updated.

[tlex]

Thanks for the reply.

I'm actually trying to avoid force_update. The CLI (default) behaviour is to always resolve the image digest (see the docker service update reference for --no-resolve-image). Basically, the tasks get recreated only if the image digest changes, while --force (or service.force_update()) always recreates the tasks.

In case it matters, my use-case is cioban, a python alternative to shepherd

[tlex]

Any updates on this?

[tlex]

Never mind, implemented a workaround with images.get_registry_data(image).