Source does not support specifying image digest

[phillbaker]

The docker image resource supports pulling images by tag. The docker commandline supports pulling images by tag and digest.

Would a pull request to add digest to the source configuration be accepted?

Original description:

This may be an issue with how concourse itself works, if so, maybe this is a documentation issue.

The docker image resource supports pulling images by tag and digest. If an image is specified by tag initially, and then the configuration is updated to specify a previously pulled digest, the most recent version of the docker image is used.

Example:

# original specification
- resources:
  - name: ansible
    type: docker-image
    source:
      repository: williamyeh/ansible
      tag: ubuntu16.04

Updated to:

- resources:
  - name: ansible
    type: docker-image
    source:
      repository: williamyeh/ansible
      digest: sha256:fad6172150bfd446bae9948b6fcec2fff95368448690fc3d807904f9ce24a272 # previous version of the `ubuntu16.04` tag, ubuntu16.04 now resolves to a different digest

Tasks resolve to using image c14d84964da7ff870c9daf184f9d130919abb6de44f62fb54e68f26bbc71a7e1.

A workaround is to turn off more recent versions of resource:

I believe that specifying the earlier pulled digest is treated as "already pulled" by the resource check, but then treated as an "older version" by concourse since there are newer resource versions.

One possible fix may be to add a hash of the specification parameters into the version metadata of this resource so that changing the specification parameters forces a new concourse resource version, here:

docker-image-resource/assets/in

Lines 97 to 104 in 380a4ca

	jq -n "{
	version: {
	digest: $(echo $digest | jq -R .)
	},
	metadata: [
	{ name: \"image\", value: $(echo $image_id | head -c 12 | jq -R .) }
	]
	}" >&3

I'm happy to contribute a PR if that makes sense.

Edit: I suppose changing the resource name would also work.

[vito]

We're about to implement this as a core feature of Concourse: concourse/concourse#2439 - so I'm gonna close this to consolidate focus into that issue. :) Thanks!