[MESOS-3505] Support specifying Docker image by Image ID.

• Type: Story
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 1.2.0
• Labels: mesosphere
• Epic Link: Unified Container
• Assignee: Ilya
• Reporter: Yan Xu
• Shepherd: Jie Yu
• Created: 23/Sep/15 22:32
• Updated: 26/Nov/18 12:20
• Resolved: 26/Nov/18 12:20

Description

A common way to specify a Docker image with the docker engine is through repo:tag, which is convenient and sufficient for most people in most scenarios. However this combination is neither precise nor immutable.

For this reason, it's possible when an image with a repo:tag already cached locally on an agent host and a task requiring this repo:tag arrives, it's using an image that's different than the one the user intended.

Docker CLI already supports referring to an image by repo@id, where the ID can have two forms:

• v1 Image ID
• digest

Native Mesos provisioner should support the same for Docker images. IMO it's fine if image discovery by ID is not supported (and thus still requiring repo:tag to be specified) (looks like v2 registry does support it) but the user can optionally specify an image ID and match it against the cached / newly pulled image. If the ID doesn't match the cached image, the store can re-pull it; if the ID doesn't match the newly pulled image (manifest), the provisioner can fail the request without having the user unknowingly running its task on the wrong image.

Issue Links

• blocks: AURORA-1824 Create a binding-helper to resolve docker tags to concrete image digests for MesosContainerizer
• blocks: AURORA-1014 Client binding_helper to resolve docker label to a stable ID at create
• is duplicated by: MESOS-5211 Allow docker puller to use docker image IDs in addition to tags