moby: docker pull with bad tag pulls by digest

Given two images:

REPOSITORY          TAG                 IMAGE ID            CREATED              SIZE
dug                 v2                  4b51b717cb17        12 minutes ago       188 MB
dug                 v1                  9f1af75fa84c        12 minutes ago       188 MB

When I do docker run dug:v1 and docker run dug:v2 the correct images are found/used. However, if instead of the image tag I used a portion of the image ID then instead of failing it works. For example: docker run dug:9f1 will run dug:v1 instead of saying it can’t find an image with tag 9f1. In looking at the docs ( https://docs.docker.com/engine/reference/commandline/pull/#pull-an-image-by-digest-immutable-identifier ) it talks about pulling image by digest but only shows examples of the syntax: ubuntu@sha256:45b23dee08af5e43a - notice the @sha256 in there.

It seems that docker shouldn’t assume a “tag” is a “digest” unless it also includes the “sha256” portion.

I believe this is happening due to the code here: https://github.com/docker/docker/blob/master/daemon/daemon.go#L1150 - it shouldn’t be calling daemon.imageStore.Search(tagged.Tag()).

However, if this is the expected behavior then we should update the docs to let people know that “tags” will be treated as “image IDs” because this isn’t what I was expecting.

ping @tonistiigi