allow to specify image digest and do not reach out to registry if digest is available in cache

[jsievers]

We were facing some hangs on our pipeline recently caused by the docker image registry being down.

Proposal:

I want to be able to pin down the image used by a task to an immutable digest anyway, sth like.

- name: hello-world-docker-image
  type: docker-image
  source:
    username: ((docker-hub-username))
    password: ((docker-hub-password))
    repository: sample_docker_registry/concourse-tutorial-hello-world
    digest: "sha256:a8a5091416981a6dd5d4fc53fb4773133e8c7627202d55831d636c60d2d1a2e1"

then, the check and in logic of docker-image-resource could first check if the digest is available in the local cache , e.g. using

docker images sample_docker_registry/concourse-tutorial-hello-world --format "{{.Digest}}"

and spare the roundtrip to the docker image registry altogether if the digest is found locally.
This would make concourse pipelines more resilient to outages of docker registries.

[CAFxX]

Agreed, without this using community resources is basically a gamble because there's no way to pin a specific version of a docker image - so you have to trust the author won't do something funny later on, or risk allowing them to run arbitrary code of their choice on your infrastructure.

[giner]

I have tried the following and it didn't work:

    name: hipchat-notification-resource
    type: docker-image
    source:
      repository: cfcommunity/hipchat-notification-resource@sha256:d1c86704c6367651e4f8a905ced8760ed835344a1df6dab7ff9fae79ca0a3057

[achawki]

Seems related to/duplicate of #187

[vito]

Yeah, gonna fold this into #187. Thanks!