Regression: Service image no longer pinned by hash in API v1.26

[matthanley]

Description

Creating a service in 17.06 fails to pin image by tag, causing subsequent calls to /v1.26/services/<service>/update failing to update to most recent image when given image:tag

Steps to reproduce the issue:

• Service created via docker-py library (using API v1.26)

Describe the results you received:

• docker service inspect shows image as provided (in image:tag format)

Describe the results you expected:

• docker service inspect show service manifest linked to SHA hash reference of the image

Additional information you deem important (e.g. issue happens only occasionally):

Seems to be related to #32388 but has affected earlier API versions.

Output of docker version:

Docker version 17.06.0-ce, build 02c1d87

[matthanley]

From additional testing, when updating a service manually via command line I'm getting the warning:

image <image>:staging could not be accessed on a registry to record
its digest. Each node will access <image>:staging independently,
possibly leading to different nodes running different
versions of the image.

<image> in this instance is hosted on a private registry, but I can docker pull <image> successfully.

---

EDIT

docker service update --image <image> --with-registry-auth <service> works without the above error, but docker service inspect still doesn't have the service image pinned.

"Spec": {
            ...
            "TaskTemplate": {
                "ContainerSpec": {
                    "Image": "***:staging",

[danieljuhl]

Probably related to / duplicate of #33929

[matthanley]

Absolutely, the description in #33929 matches what I'm seeing.

(I don't think this should be a dup though, as this issue is specifically relating to the regression breaking backwards compatibility with an existing API version)

[vdemeester]

cc @aaronlehmann @nishanttotla @thaJeztah

[danieljuhl]

The other issue is also a regression breaking backwards comp., just on the CLI and not through the API. But I suspect that the root for both issues is the same, which just affects all possible ways to trigger the update.