moby: Unclear error messages creating Swarm service with image from local library

Hi @nishanttotla. The explanation behind the warning makes perfect sense, but it is not an ideal solution right now since it causes needless anxiety during a typical development scenario, i.e., working with images that haven’t been assigned digests because they haven’t yet been pushed to any registry. Errors, denied and unauthorized appearing in message sound sinister because they should be taken seriously and not ignored – which is of course what you want in a cluster scenario as you noted (but even then the current phrasing doesn’t quite make it clear what’s going on if you don’t already understand the issue).

I don’t know how to phrase it best, but a naive verbose attempt is something like the following:

Warning: unable to pin image pinger to digest because it wasn't found in the registry.
This can lead to problems in a cluster because the image on each node might not be identical
(even though they might have the same tag).

Warning: unable to pin image pinger to digest because authentication is required to access
the registry. This can lead to problems in a cluster because the image on each node might not
be identical (even though they might have the same tag).

Wording stuff is hard! 😉

If anyone else lands here and if not sure what this means, I’ll try to paraphrase:

This is just a warning and not an error which translated means “we could not find your image on the internet (Hub) or another registry, so we’ll use your local image instead”.

• You won’t be able to scale your image over multiple hosts unless they have the exact matching image

Thanks @nishanttotla

Regarding the “warning” message: as many others I was confused with it… As you stated: “This happens by contacting the registry to retrieve the digest (#28173). If the digest pinning fails, a warning is returned”

IIUC: Docker image picking process checks locally first (before looking on any registry). According to that, -as I provided image:tag- it should match and use it without any warning or checking any registry. At most, it should check local image digest without problems.

So, I don’t understand what the message means. Could you elaborate a bit to better understand what’s going on and improve/remove/whatever the message behavior? Thanks

I am also getting the same issue

unable to pin image my-prometheus to digest: errors:
denied: requested access to the resource is denied
unauthorized: authentication required```

@mostolog @nishanttotla im having this exact same issue with local images.

@alexellis @mostolog thanks for your suggestions. This is a little tricky and I see all your points. I’m currently working on a PR to make an attempt to make this warning system better, stay tuned.

#31713 fixes the warnings received, by making them more concise and explanatory.

From the description above, I see that the service was successfully created, but it does seem like the UX is a little confusing in that case. I’ll think about how we can make this better.

I just checked this issue (was AFK when I commented above), and can confirm that the service is created as usual and a 0 exit code is returned, so there’s no regression since 1.12, purely cosmetic / UX

Maybe the error should include “how” docker proceeded (creating service using local image cache)?

did this work on docker 1.12 (which also performed a pull when deploying a service)?

docker 1.13 pins images by digest to ensure all instances of a service run exactly the same version of the image; this resolution is handled through the registry. I suspect the error is due to this.

@nishanttotla could you have a look?