Image value in docker_service state doesn't stick

[ragurakesh]

Terraform Version

terraform:0.12.29
provider-docker version: 2.5.0

Affected Resource(s)

• docker_service

Terraform Configuration Files

provider "docker" {
  version = "~> 2.5.0"
  alias   = "default"
}

resource "docker_service" "foo" {
  name = "foo-service"

  task_spec {
    container_spec {
      image = "nginx:latest"
    }
  }

  endpoint_spec {
    ports {
      target_port = "8080"
    }
  }
}

Apply Output

$ terraform apply

An execution plan has been generated and is shown below.
Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # docker_service.foo will be created
  + resource "docker_service" "foo" {
      + id     = (known after apply)
      + labels = (known after apply)
      + name   = "foo-service"

      + endpoint_spec {
          + mode = (known after apply)

          + ports {
              + protocol     = "tcp"
              + publish_mode = "ingress"
              + target_port  = 8080
            }
        }

      + mode {
          + global = (known after apply)

          + replicated {
              + replicas = (known after apply)
            }
        }

      + task_spec {
          + force_update   = (known after apply)
          + restart_policy = (known after apply)
          + runtime        = (known after apply)

          + container_spec {
              + image             = "nginx:latest"
              + isolation         = "default"
              + stop_grace_period = (known after apply)

              + dns_config {
                  + nameservers = (known after apply)
                  + options     = (known after apply)
                  + search      = (known after apply)
                }

              + healthcheck {
                  + interval     = (known after apply)
                  + retries      = (known after apply)
                  + start_period = (known after apply)
                  + test         = (known after apply)
                  + timeout      = (known after apply)
                }
            }

          + placement {
              + constraints = (known after apply)
              + prefs       = (known after apply)

              + platforms {
                  + architecture = (known after apply)
                  + os           = (known after apply)
                }
            }

          + resources {
              + limits {
                  + memory_bytes = (known after apply)
                  + nano_cpus    = (known after apply)

                  + generic_resources {
                      + discrete_resources_spec = (known after apply)
                      + named_resources_spec    = (known after apply)
                    }
                }

              + reservation {
                  + memory_bytes = (known after apply)
                  + nano_cpus    = (known after apply)

                  + generic_resources {
                      + discrete_resources_spec = (known after apply)
                      + named_resources_spec    = (known after apply)
                    }
                }
            }
        }
    }

Plan: 1 to add, 0 to change, 0 to destroy.

Do you want to perform these actions?
  Terraform will perform the actions described above.
  Only 'yes' will be accepted to approve.

  Enter a value: yes

docker_service.foo: Creating...
docker_service.foo: Creation complete after 5s [id=dgyjey68z60ke8wploo9jpfme]

Apply complete! Resources: 1 added, 0 changed, 0 destroyed.
$

Expected Behavior

Once the above configuration is applied, docker service shall run nginx container, and applying the same terraform configuration again shall not cause the running container to be recycled.

Actual Behavior

Plan shows change in the image configured in the docker_service. If applied again, it causes the running container to get recycled.

$ terraform plan
Refreshing Terraform state in-memory prior to plan...
The refreshed state will be used to calculate this plan, but will not be
persisted to local or remote state storage.

docker_service.foo: Refreshing state... [id=dgyjey68z60ke8wploo9jpfme]

------------------------------------------------------------------------

An execution plan has been generated and is shown below.
Resource actions are indicated with the following symbols:
  ~ update in-place

Terraform will perform the following actions:

  # docker_service.foo will be updated in-place
  ~ resource "docker_service" "foo" {
        id     = "dgyjey68z60ke8wploo9jpfme"
        labels = {}
        name   = "foo-service"

        endpoint_spec {
            mode = "vip"

            ports {
                protocol       = "tcp"
                publish_mode   = "ingress"
                published_port = 0
                target_port    = 8080
            }
        }

        mode {
            global = false

            replicated {
                replicas = 1
            }
        }

      ~ task_spec {
            force_update   = 0
            networks       = []
            restart_policy = {
                "condition"    = "any"
                "max_attempts" = "0"
            }
            runtime        = "container"

          ~ container_spec {
                args              = []
                command           = []
                env               = {}
                groups            = []
               ~ image             = "nginx:latest@sha256:b0ad43f7ee5edbc0effbc14645ae7055e21bc1973aee5150745632a24a752661" -> "nginx:latest"
                isolation         = "default"
                labels            = {}
                read_only         = false
                stop_grace_period = "0s"

                dns_config {}

                healthcheck {
                    interval     = "0s"
                    retries      = 0
                    start_period = "0s"
                    test         = []
                    timeout      = "0s"
                }
            }

            placement {
                constraints = []
                prefs       = []

                platforms {
                    architecture = "amd64"
                    os           = "linux"
                }
            }

            resources {
            }
        }
    }

Plan: 0 to add, 1 to change, 0 to destroy.

------------------------------------------------------------------------

Note: You didn't specify an "-out" parameter to save this plan, so Terraform
can't guarantee that exactly these actions will be performed if
"terraform apply" is subsequently run.
$

$ docker ps -a
CONTAINER ID        IMAGE               COMMAND                  CREATED             STATUS                        PORTS               NAMES
07522dc88570        nginx:latest        "/docker-entrypoint.…"   23 seconds ago      Up 19 seconds                 80/tcp              foo-service.1.v7t3mqux9w3h4xdwft8hxpx9p
8e2cc03cf8e1        nginx:latest        "/docker-entrypoint.…"   9 minutes ago       Exited (137) 22 seconds ago                       foo-service.1.4humubt05iongzdxf5xvjsm79
$ 

Steps to Reproduce

1. terraform apply above configuraion
2. terraform apply again the same configuration
3. docker ps -a